21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 78:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4de,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_70% Sample 83d48ca1aa22… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 83d48ca1aa22…. Malware family: Win/grayware_confidence_70%. Threat score 100/100. 1/24 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0","keywords":["Malicious","Win/grayware_confidence_70%","malware analysis","sandbox report","threat intelligence","83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Program.Unwanted.4468.24384.5290","applicationCategory":["peexe","executable"],"identifier":"83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_70%","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAALu7u7u7sAAAAAAAAAAAALu7u7u7u7MiAAAAAAAAAAu7u7u7u7uzJmAAAAAAAAC7u7u7u7u7uzZmAAAAAAALu7u7u7u7u7uwZmAAAAAAu7u7u7u7u7u7sGZmAAAAC7u7u7u7u7u7u7BmZiAAAAu7u7u7u7u7u7uwZmYgAAALu7u7u7u7u7u7sGZmJgAAC7u7u7u7u7u7u7BmZiYAAAAzu7u7u7u7u7uwZmYmAABmZru7u7u7u7u7BmZmJgAAZmALu7u7u7u7uwZmZibwD2YAAAu7u7u7u7sGZmYm8A9mZgAAALu7u7uwBmZmJvAPZmZgAAAAu7u7sGZmZibwAGZmZmAAAAC7u7BmZmYmAABmZmZmYAAAALsAZmZmJgAAZmZmZmZmAAAAAGZmZiYAAGZmZmZmZmYAAAAGZmImAAAGZmZmZmZmZgAAAAABEAAABmZmZmZmZmYAEREAERAAAABmZmZmZmZgAREREREAAAAABmZmZmZmABERERERAAAAAABmZmZmYAERERERAAAAAAAABmZmZgAREREREAAAAAAAAAAGZlEREREREQAAAAAAAAAAAAABEREREAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////w////AB///AAD//gAAf/wAAD/4AAEf8AABD+AAAQfgAAEH4AABA+AAAQPwAAEDwAACA8YAAgGPgAIBg/AGAYH8BAHAfwQDwB/MA8AD/APAAP4D4AA/5+AAMMfwAGAP+ADAD/wBgD/+AwB//4AA///4B////D///////w==23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAALu7u7u7sAAAAAAAAAAAALu7u7u7u7MiAAAAAAAAAAu7u7u7u7uzJmAAAAAAAAC7u7u7u7u7uzZmAAAAAAALu7u7u7u7u7uwZmAAAAAAu7u7u7u7u7u7sGZmAAAAC7u7u7u7u7u7u7BmZiAAAAu7u7u7u7u7u7uwZmYgAAALu7u7u7u7u7u7sGZmJgAAC7u7u7u7u7u7u7BmZiYAAAAzu7u7u7u7u7uwZmYmAABmZru7u7u7u7u7BmZmJgAAZmALu7u7u7u7uwZmZibwD2YAAAu7u7u7u7sGZmYm8A9mZgAAALu7u7uwBmZmJvAPZmZgAAAAu7u7sGZmZibwAGZmZmAAAAC7u7BmZmYmAABmZmZmYAAAALsAZmZmJgAAZmZmZmZmAAAAAGZmZiYAAGZmZmZmZmYAAAAGZmImAAAGZmZmZmZmZgAAAAABEAAABmZmZmZmZmYAEREAERAAAABmZmZmZmZgAREREREAAAAABmZmZmZmABERERERAAAAAABmZmZmYAERERERAAAAAAAABmZmZgAREREREAAAAAAAAAAGZlEREREREQAAAAAAAAAAAAABEREREAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////w////AB///AAD//gAAf/wAAD/4AAEf8AABD+AAAQfgAAEH4AABA+AAAQPwAAEDwAACA8YAAgGPgAIBg/AGAYH8BAHAfwQDwB/MA8AD/APAAP4D4AA/5+AAMMfwAGAP+ADAD/wBgD/+AwB//4AA///4B////D///////w==24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAALu7u7u7sAAAAAAAAAAAALu7u7u7u7MiAAAAAAAAAAu7u7u7u7uzJmAAAAAAAAC7u7u7u7u7uzZmAAAAAAALu7u7u7u7u7uwZmAAAAAAu7u7u7u7u7u7sGZmAAAAC7u7u7u7u7u7u7BmZiAAAAu7u7u7u7u7u7uwZmYgAAALu7u7u7u7u7u7sGZmJgAAC7u7u7u7u7u7u7BmZiYAAAAzu7u7u7u7u7uwZmYmAABmZru7u7u7u7u7BmZmJgAAZmALu7u7u7u7uwZmZibwD2YAAAu7u7u7u7sGZmYm8A9mZgAAALu7u7uwBmZmJvAPZmZgAAAAu7u7sGZmZibwAGZmZmAAAAC7u7BmZmYmAABmZmZmYAAAALsAZmZmJgAAZmZmZmZmAAAAAGZmZiYAAGZmZmZmZmYAAAAGZmImAAAGZmZmZmZmZgAAAAABEAAABmZmZmZmZmYAEREAERAAAABmZmZmZmZgAREREREAAAAABmZmZmZmABERERERAAAAAABmZmZmYAERERERAAAAAAAABmZmZgAREREREAAAAAAAAAAGZlEREREREQAAAAAAAAAAAAABEREREAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////w////AB///AAD//gAAf/wAAD/4AAEf8AABD+AAAQfgAAEH4AABA+AAAQPwAAEDwAACA8YAAgGPgAIBg/AGAYH8BAHAfwQDwB/MA8AD/APAAP4D4AA/5+AAMMfwAGAP+ADAD/wBgD/+AwB//4AA///4B////D///////w==25:T527d,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00003344) "setup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msi.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002444) "setup.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002444) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003052) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\SCM\WPFOSD.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RSTRTMGR.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNELBASE.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SFC.DLL (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter CABINET (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\SCM\EyeTracking\Tobii.EyeX.Client.Net20.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\SCM\MSIECO.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004044) "msiexec.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004044) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8474.tmp (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8AAF.tmp (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00003600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00003600) "MSIService.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002636) "MSIService.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636) "MSIService.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636) "MSIService.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002636) "MSIService.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636) "CloseSCM.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001512) "CloseSCM.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001512)26:T4f7,The input sample is signed with a certificate issued by "CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE" (SHA1: 8A:D5:C9:98:7E:6F:19:0B:D6:F5:41:6E:2D:E4:4C:CD:64:1D:8C:DA; see report for more information) The input sample is signed with a certificate issued by "CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US" (SHA1: 85:48:71:D1:4F:C2:B5:B1:24:F8:DC:07:13:2D:74:76:67:4E:9C:33; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO Time Stamping CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 48:8E:CF:B1:EC:D6:27:14:E9:E4:6E:6A:A1:74:08:C5:5A:7A:55:B5; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: F3:92:C6:90:60:C6:BE:48:75:62:A6:A8:23:98:5E:AB:58:E1:AC:96; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)27:Td91,"MSIWmiAcpi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIWmiAcpi.dll]- [targetUID: 00000000-00002636] "Tobii.EyeX.Client.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\Tobii.EyeX.Client.dll]- [targetUID: 00000000-00004044] "WPFOSD.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\WPFOSD.dll]- [targetUID: 00000000-00004044] "SCM_Notice.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\SCM_Notice.exe]- [targetUID: 00000000-00004044] "devcon.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\devcon.dll]- [targetUID: 00000000-00004044] "SCM.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\SCM.exe]- [targetUID: 00000000-00004044] "DeviceCount.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\System32\DeviceCount.exe]- [targetUID: 00000000-00004044] "MSIService.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIService.exe]- [targetUID: 00000000-00004044] "EyeXFramework.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\EyeXFramework.dll]- [targetUID: 00000000-00004044] "System.Windows.Interactivity.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\System.Windows.Interactivity.dll]- [targetUID: 00000000-00004044] "MSIECO.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIECO.dll]- [targetUID: 00000000-00004044] "CloseSCM.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\CloseSCM.exe]- [targetUID: 00000000-00001512] "EyeTracking.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\EyeTracking.exe]- [targetUID: 00000000-00004044] "MSIODD.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIODD.dll]- [targetUID: 00000000-00004044] "msiapcfg.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\msiapcfg.dll]- [targetUID: 00000000-00004044] "SETUP.EXE.65AE6164.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI8AAF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI8AAF.tmp]- [targetUID: 00000000-00003600] "Tobii.EyeX.Client.Net20.DLL" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL]- [targetUID: 00000000-00004044] "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\DRPTools\SCMx86\setup.exe]- [targetUID: 00000000-00002444] "MSI8474.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI8474.tmp]- [targetUID: 00000000-00003600]28:T4f6,Found reference to API "CreateService failed - %s" (Indicator: "CreateService"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerA" (Indicator: "RegisterServiceCtrlHandler"; File: "MSIService.exe.2424824512") Found reference to API "CreateServiceA" (Indicator: "CreateService"; File: "MSIService.exe.2424824512") Found reference to API "CreateService failed - %s" (Indicator: "CreateService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerA" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp")29:T91a,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb17588c829000050fd7f9a5c637700f0fd7fe8c312004450fd7f00000000400000003f0000001d0000000050fd7fdcc31200c15c637760826a771d0000000050fd7f9a5c637700f0fd7f00c412005789627780836a7713177a75d8ebb175 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000054f2120002000000000000001000000094f11200b0f11200c97679750000250000001400da7679751d810d27000000000000876901000000935c637700000000000000000000000078f112000100000048f41200bd067b754d06665200000000bd148769c8362900 (UID: 00000000-00003344) "setup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002444) "setup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb175586c580000d0fd7f9a5c637700e0fd7f18c5100344d0fd7f00000000400000003f0000002a00000000d0fd7f0cc51003c15c637760826a772a00000000d0fd7f9a5c637700e0fd7f30c510035789627780836a7713177a75d8ebb175 (UID: 00000000-00002444) "CloseSCM.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30333a35332e313430222c52583d302c50583d300030006c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d224d616368696e65 (UID: 00000000-00001512) "CloseSCM.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e8b94a00dcf91b00145c6277435c6277a8fa1b000100000094014800010000005cf91b00935c637740836a77d4a06277b2b86177a8fa1b00010000000100000030ec4a00000000002cf91b005cf91b00c8f91b0095e15e7716451800feffffffd4a062771bbe79750000b17600000000 (UID: 00000000-00001512)2a:T80f,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "MSIService.exe.2424824512") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")2b:Ta97,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe.Local\" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\UXTHEME.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\FLTLIB.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\USERENV.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\SETUPAPI.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\APPHELP.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\PROPSYS.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\DWMAPI.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\OLEACC.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\OLEACCRC.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\CLBCATQ.dll" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to touch file "C:\Windows\system32\VERSION.dll"2c:T469,"MSIWmiAcpi.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "Tobii.EyeX.Client.dll" was detected as "Borland Delphi 3.0 (???)" "WPFOSD.dll" was detected as "Microsoft visual C# v7.0 / Basic .NET" "SCM_Notice.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "devcon.dll" was detected as "Borland Delphi 3.0 (???)" "SCM.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "DeviceCount.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "MSIService.exe" was detected as "Visual C++ 2008 Release -> Microsoft" "EyeXFramework.dll" was detected as "Microsoft visual C# / Basic .NET" "MSIECO.dll" was detected as "Microsoft visual C# v7.0 / Basic .NET" "CloseSCM.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "EyeTracking.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "MSIODD.dll" was detected as "Microsoft visual C# v7.0 / Basic .NET" "msiapcfg.dll" was detected as "Microsoft visual C++ vx.x DLL" "SETUP.EXE.65AE6164.bin" was detected as "VC8 -> Microsoft Corporation" "Tobii.EyeX.Client.Net20.DLL" was detected as "Microsoft visual C# / Basic .NET"2d:T90e,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "QuerySystemInformationW" (Indicator: "QuerySystemInformation"; Source: "00000000-00001512.00000000.70583.00480000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")2e:T85b,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryA" with parameter C:\Windows (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryA" with parameter %WINDIR%\TEMP (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryA" with parameter %WINDIR%\TEMP\DRPTools (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateDirectoryA" with parameter %WINDIR%\TEMP\DRPTools\SCMx86 (UID: 00000000-00003344) "setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002444) "msiexec.exe" called "CreateDirectoryW" with parameter C:\MSI78ba5.tmp (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter Z:\MSI78ba6.tmp (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Templates (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Fonts (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Config.Msi (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SCM (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SCM\EyeTracking (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SCM\MSIECO (UID: 00000000-00004044) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB} (UID: 00000000-00004044)2f:Tb08,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002444.0000098C.3617166.00050000.wprm] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003344-00000C25-17729102] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00003344-00000C25-28419862] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00003344-00000C25-28670678] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00003344-00000C25-28734700] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00003344-00000C25-28755171] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003344-00000C25-28775772] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003344-00000C25-28820433] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003344-00000C25-28869367] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00003344-00000C25-28890132] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003344-00000C25-28915357] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00003344-00000C25-29281964] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003344-00000C25-29849256] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003344-00000C25-29915855] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00003344-00000C25-31494392] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00002444-00000C25-21205746] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00002444-00000C25-21427120] Observed system executable string:"%WINDIR%\system32\OLE32.DLL" [Source: 00000000-00002444-00000C25-21509813] Observed system executable string:"%WINDIR%\system32\NETAPI32.DLL" [Source: 00000000-00003052-00000C25-23292725] Observed system executable string:"%WINDIR%\system32\TSAPPCMP.DLL" [Source: 00000000-00003052-00000C25-33962442] Observed system executable string:"%WINDIR%\system32\SHLWAPI.DLL" [Source: 00000000-00003052-00000C25-34008333] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00003052-00000C25-34248051] Observed system executable string:"%WINDIR%\system32\SHELL32.DLL" [Source: 00000000-00003052-00000C25-66979622] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00004044-00000C25-24202414] Observed system executable string:"%WINDIR%\system32\RPCRT4.DLL" [Source: 00000000-00004044-00000C25-24725448]30:Tae9,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WMIACPI"; Key: "MOFIMAGEPATH"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")31:Tce9,Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartServiceCtrlDispatcher"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartService"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "StartService failed - %s" (Indicator: "StartService"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartServiceCtrlDispatcher"; File: "MSIService.exe.2424824512") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartService"; File: "MSIService.exe.2424824512") Found reference to API "StartServiceA" (Indicator: "StartService"; File: "MSIService.exe.2424824512") Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002560.00000000.70310.00AF0000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartService"; Source: "00000000-00002560.00000000.70310.00AF0000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher being called." (Indicator: "StartService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartService failed - %s" (Indicator: "StartService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceA" (Indicator: "StartService"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "StartServices" (Indicator: "StartService"; Source: "00000000-00004044.00000001.69892.017E0000.00000004.mdmp, 00000000-00004044.00000001.69892.02050000.00000004.mdmp, 00000000-00004044.00000002.71810.017EB000.00000004.mdmp")32:T9161,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001512.00000000.70574.00BC4000.00000002.mdmp") Found URL "http://downloadmanagersoftware\microsoft\visualstudio\setupurldownloadtocachefile" - Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=49256" - Source: "00000000-00002444.00000002.70721.00C45000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=182804" - Source: "00000000-00002444.00000002.70721.00C45000.00000002.mdmp") Found URL "http://www.support.microsoft.com/common/international.aspx" - Source: "00000000-00002444.00000002.70721.00C45000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=66406&clcid=0x409" - Source: "00000000-00002444.00000002.70721.00C45000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=66406" - Source: "00000000-00002444.00000002.70721.00C45000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_46f6_9a99_df0f2bd4c077" - Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_46f6_9a99_df0f2bd4c077" - Source: "00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_46f6_9a99_df0f2bd4c077" - Source: "00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found URL "http://www.support.microsoft.com/common/international.aspx" - Source: "00000000-00003344.00000000.67508.00414000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=66406&clcid=0x409" - Source: "00000000-00003344.00000000.67508.00414000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=66406" - Source: "00000000-00003344.00000000.67508.00414000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00003344.00000000.67508.00414000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0b;09070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0^lx" - Source: "00000000-00003344.00000000.67508.00414000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.caben-usmsafd" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0a0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/^\z=pttzientrust.net1;092www.entrust.net/cps" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0b;09070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0^lx" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0_w" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:rpdf1.3.6.1.4.1.311.2.1.40w020!0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crzfuscdigicert" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!vq'=%2+jo;8kbsp" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0exx(pijlf04o0-%i1;rgx](" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7verisign" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?^a" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=yxqf9frtqv26378159195,3880,3,hfindfile,0,0vasychttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s9quuusp" - Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/sha2-assured-cs-g1.crlhttp://crl4.digicert.com/sha2-assured-cs-g1.crla" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_46f6_9a99_df0f2bd4c077" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0a0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/^\z=pttzientrust.net1;092www.entrust.net/cps" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0_w" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:rpdf7unt6urpdfel32.dll," - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0b;09070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0^lx" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://cr^x;=vq;=wu1.3.6.1.4.1.311.21.7wzu1.3.6.1.5.5.7.48.1.1hzu1.3.6.1.5.5.7.1.12ilzu1.3.6.1.5.5.7.1.2ozu1.2.840.10045.4.3nzu1.2.840.10045.2.1ozu1.2.840.113549.1.1.10rzu1.2.840.113549.1.1.7euzuzzu^5zu" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!vq'=%2+jo;8kbsp" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0exx(pijlf04o0-%i1;rgx](" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7verisign" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?^a" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=yxqf9frtqv26378159195,3880,3,hfindfile,0,0vasychttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s9quuusp" - Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl4.digicert.com/digicertassuredidrootca.crlhttp://crl3.digicert.com/digicertassuredidrootca.crlidentifierdescriptionkeycolumndllsurrogatelocalserviceactiontextconditionthe" - Source: "00000000-00004044.00000001.69892.017E0000.00000004.mdmp") Found URL "http://go.micra.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_4sa99_df0f2bd4c077s_sans_serif13.0_0_0" - Source: "00000000-00004044.00000001.69892.02050000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/sha2-assured-cs-g1.crlhttp://crl4.digicert.com/sha2-assured-cs-g1.crla" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=131000vsddialogs.83d22742_1b79_46f6_9a99_df0f2bd4c077" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0a0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/^\z=pttzientrust.net1;092www.entrust.net/cps" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0_w" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:7unt6uel32.dll," - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0b;09070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0^lx" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://cr_" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!vq'=%2+jo;8kbsp" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0exx(pijlf04o0-%i1;rgx](" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7verisign" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?^a" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=yxqf9frtqv26378159195,3880,3,hfindfile,0,0vasychttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s91.3.6.1.4.1.311.10.1201210215646z0/^g(o-cejy" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s9quuusp" - Source: "00000000-00004044.00000002.71810.001C0000.00000004.mdmp")33:T8fa,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4768800'}" (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4768832'}" (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4768672'}" (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4768784'}" (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '1997209600', 'hResInfo': '3868144'}" (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4768768'}" (UID: 00000000-00003344) "setup.exe" called "LoadResource with parameter {'hModule': '12517376', 'hResInfo': '12869760'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '12517376', 'hResInfo': '12869648'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12869824'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12869840'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12870032'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12869920'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12869904'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12870624'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '12517376', 'hResInfo': '12869744'}" (UID: 00000000-00002444) "setup.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12869888'}" (UID: 00000000-00002444) "msiexec.exe" called "LoadResource with parameter {'hModule': '1849819138', 'hResInfo': '1704976'}" (UID: 00000000-00003052)34:T5b3,RegDeleteKeyA RegCloseKey OpenProcessToken RegDeleteValueA RegCreateKeyExA RegOpenKeyExA RegEnumKeyA GetFileAttributesA CopyFileA GetModuleFileNameA LoadLibraryExA GetFileSize CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetTempPathA CreateThread GetModuleHandleA FindFirstFileA WriteFile GetTempFileNameA FindNextFileA GetSystemDirectoryA CreateProcessA Sleep CreateFileA GetTickCount ShellExecuteExA FindWindowExA RegEnumKeyExA FindResourceExW GetModuleFileNameW UnhandledExceptionFilter ExitThread TerminateProcess LoadLibraryW VirtualProtect GetVersionExA LoadLibraryA GetStartupInfoW GetFileSizeEx CreateFileW GetSystemInfo LockResource IsDebuggerPresent GetModuleHandleW FindResourceW GetFileAttributesExA FindResourceA VirtualAlloc ShellExecuteA GetCursorPos GetLastActivePopup SetWindowsHookExA GetWindowThreadProcessId GetUpdateRect GetTickCount64 OutputDebugStringA RegDeleteValueW GetFileAttributesW OutputDebugStringW LoadLibraryExW GetModuleHandleExW FindNextFileW FindFirstFileW GetCommandLineW StartServiceA StartServiceCtrlDispatcherA CreateServiceA ConnectNamedPipe DisconnectNamedPipe GetStartupInfoA GetTempPathW CopyFileW GetSystemDirectoryW CreateToolhelp32Snapshot GetVersionExW OpenProcess CreateDirectoryW DeleteFileW GetTempFileNameW GetNativeSystemInfo Process32NextW Process32FirstW ShellExecuteW ShellExecuteExW InternetCrackUrlW35:T4a1,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "MSIService.exe.2424824512") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "MSIService.exe.2424824512") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")36:Tb67,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290" was detected as "Microsoft Linker" and name: "Linker" "MSIWmiAcpi.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MSIWmiAcpi.dll" was detected as "Microsoft Linker" and name: "Linker" "Tobii.EyeX.Client.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Tobii.EyeX.Client.dll" was detected as "Microsoft Linker" and name: "Linker" "WPFOSD.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WPFOSD.dll" was detected as "Microsoft Linker" and name: "Linker" "SCM_Notice.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SCM_Notice.exe" was detected as "Microsoft Linker" and name: "Linker" "devcon.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "devcon.dll" was detected as "Microsoft Linker" and name: "Linker" "SCM.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SCM.exe" was detected as "Microsoft Linker" and name: "Linker" "DeviceCount.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "DeviceCount.exe" was detected as "Microsoft Linker" and name: "Linker" "MSIService.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MSIService.exe" was detected as "Microsoft Linker" and name: "Linker" "EyeXFramework.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "EyeXFramework.dll" was detected as "Microsoft Linker" and name: "Linker" "MSIECO.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MSIECO.dll" was detected as "Microsoft Linker" and name: "Linker" "CloseSCM.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "CloseSCM.exe" was detected as "Microsoft Linker" and name: "Linker" "EyeTracking.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "EyeTracking.exe" was detected as "Microsoft Linker" and name: "Linker" "MSIODD.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MSIODD.dll" was detected as "Microsoft Linker" and name: "Linker" "msiapcfg.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msiapcfg.dll" was detected as "Microsoft Linker" and name: "Linker" "SETUP.EXE.65AE6164.bin" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SETUP.EXE.65AE6164.bin" was detected as "Microsoft Linker" and name: "Linker" "Tobii.EyeX.Client.Net20.DLL" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Tobii.EyeX.Client.Net20.DLL" was detected as "Microsoft Linker" and name: "Linker"37:Tb5d,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\SCMx86\msiexec.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\SCMx86\setup.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\ArmedAndDangerous.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\inetsrv\w3wp.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\INSTALL.EXE" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\INSTMENU.EXE" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\Installer.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\welcome.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\SETUP.EXE" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\MFSetup.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\NCDStart.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\NCGSTART.EXE" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\vpc.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\Asteroids.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Temp\DRPTools\SV4SETUP.EXE" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Temp\DRPTools\PCSONIC.EXE"38:T8e1,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETUP.EXE"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCOMPATIBILITY"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SETUP.EXE"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")39:T5bc,Process "msiexec.exe" (UID: 00000000-00003052) was launched with new environment variables: "__PROCESS_HISTORY="%WINDIR%\TEMP\DRPTools\SCMx86\setup.exe"" Process "msiexec.exe" (UID: 00000000-00004044) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00004044) was launched with missing environment variables: "LOGONSERVER, __PROCESS_HISTORY, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00003600) was launched with new environment variables: "LOGONSERVER="\\%OSUSER%-PC", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00003600) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, TEMP, USERPROFILE, TMP" Process "MSIService.exe" (UID: 00000000-00002560) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "MSIService.exe" (UID: 00000000-00002560) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "CloseSCM.exe" (UID: 00000000-00001512) was launched with new environment variables: "LOGONSERVER="\\%OSUSER%-PC", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "CloseSCM.exe" (UID: 00000000-00001512) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP"3a:T1ee7,Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "H&%m.Tk" Heuristic match: "gi.Kn" Heuristic match: "+I.km" Heuristic match: "-SnD/.rU" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://schemas.microsoft.com/expression/2010/interactivity:http://schemas.microsoft.com/expression/2010/interactivitySystem.Windows.InteractivityxMicrosoft.Expression.DesignSurface.UnitTests" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "j.Xju/j,XjYu" Pattern match: "crl.microsoft.com/pki/crl/products/CSPCA.crl0H" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "ame=SCMx86Setup.ms" Pattern match: "go.microsoft.com/fwlink/?linkid=182804" Pattern match: "go.microsoft.com/fwlink/?LinkId=49256" Heuristic match: "oft.co" Heuristic match: "t .NET" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MX" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=49256" Pattern match: "http://go.microsoft.com/fwlink/?linkid=182804" Pattern match: "http://www.support.microsoft.com/common/international.aspx}}{\fldrslt{\cf1\ul\b0" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=66406&clcid=0x409" Heuristic match: "CgiY.gi" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=131000" Heuristic match: "uJSE;.WSF;.WSH;.MX" Heuristic match: "asters.ad" Heuristic match: "c:\windows\temp\drptools\scmx86\files\ad10th\toasters.ad" Pattern match: "www.SamLab.ws" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com110/" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0B" Pattern match: "http://ocsp.digicert.com0N" Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0" Heuristic match: ";.VBE;.JS;.JSE;.WSF;.WS" Heuristic match: ".JS;.JSE;.WSF;.WSH;.MT" Heuristic match: "JS;.JSE;.WSF;.WS" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Heuristic match: ";uY.gi" Pattern match: "http://www.usertrust.com1" Pattern match: "www.google.com0" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca.com/UTN-USERFirst-Hardware.crl06" Pattern match: "crl.comodo.net/UTN-USERFirst-Hardware.crl0q" Pattern match: "http://crt.comodoca.com/UTNAddTrustServerCA.crt0$" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/CPS/OmniRoot.html0" Pattern match: "www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "2www.entrust.net/CPS" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/DomOvLatestCRL.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0" Pattern match: "www.verisign.com/repository/CPS" Pattern match: "https://www.verisign.com/repository/CPS" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0D" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g.symcd.com0" Pattern match: "http://www.geotrust.com/resources/cps06" Pattern match: "http://g.symcb.com/GeoTrustPCA-G3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://ocsp.entrust.net0D" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Heuristic match: "F.com" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.digicert.com1+0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.digicert.com1" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://ocsp.digicert.com" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl" Pattern match: "http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl" Pattern match: "http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl" Heuristic match: "a767.dspw65.akamai.net" Heuristic match: "download.windowsupdate.com.edgesuite.net" Heuristic match: "wu-bg-shim.trafficmanager.net" Heuristic match: "-bg-shim.trafficmanager.net" Heuristic match: "phicdn.net" Heuristic match: "fp2e7a.wpc.phicdn.net" Heuristic match: "ocsp.edge.digicert.com" Heuristic match: "fp2e7a.wpc.2be4.phicdn.net"3b:Tdff,"msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "AUTHORIZEDCDFPREFIX") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "COMMENTS") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "CONTACT") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "DISPLAYVERSION") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "HELPLINK") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "HELPTELEPHONE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "INSTALLDATE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "INSTALLLOCATION") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "INSTALLSOURCE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "MODIFYPATH") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "PUBLISHER") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "README") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "SIZE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "ESTIMATEDSIZE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "UNINSTALLSTRING") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "URLINFOABOUT") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "URLUPDATEINFO") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "VERSIONMAJOR") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\094A5790D04BC3547952A8CD887A89BA\INSTALLPROPERTIES"; Key: "VERSIONMINOR")3c:T9b8,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3d:T945,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "setup.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "setup.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "msiexec.exe" failed to load missing module "%WINDIR%\system32\TSAPPCMP.DLL" - [base:0; Status:c0000135] "msiexec.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "msiexec.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "msiexec.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "msiexec.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "MSIService.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MSIService.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "CloseSCM.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135]3e:Ta05,Found string "~PaEs" (Indicator: "aes"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") file/memory contains long string with (Indicator: "aes"; File: "MSIService.exe") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001512.00000000.70574.01D20000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001512.00000000.70574.01D20000.00000004.mdmp") Found string "DGaesung" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "MDGaesung" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "@MDGaesung" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "Yhaeseo" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "HYhaeseo" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "@HYhaeseo" (Indicator: "aes"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "DGaesung" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "MDGaesung" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "@MDGaesung" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "Yhaeseo" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "HYhaeseo" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "@HYhaeseo" (Indicator: "aes"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.017E0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp")3f:T9ea,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "3188,,LookupAccountSidW,J" (Indicator: "LookupAccountSid"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "3188,,LookupAccountSidW," (Indicator: "LookupAccountSid"; Source: "00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")40:T924,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegDeleteKeyTransactedA" (Indicator: "RegDeleteKeyTransacted"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegDeleteKeyTransactedA" (Indicator: "RegDeleteKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00003600.00000000.69612.00270000.00000004.mdmp, 00000000-00003600.00000001.70692.00270000.00000004.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp")41:T420,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "570493184" "cx": "450" "cy": "18"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1812007915" "cx": "503" "cy": "25"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "570493184" "cx": "16" "cy": "16"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "570493184" "cx": "75" "cy": "23"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "167839791" "cx": "450" "cy": "18"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1812007915" "cx": "450" "cy": "18"} "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2315324130" "cx": "225" "cy": "23"}42:Ta9c,"MSIWmiAcpi.dll" contains export function called "??0CMSIWmiAcpi@@QAE@XZ" at ordinal 1 "MSIWmiAcpi.dll" contains export function called "??1CMSIWmiAcpi@@QAE@XZ" at ordinal 2 "MSIWmiAcpi.dll" contains export function called "??4CMSIWmiAcpi@@QAEAAV0@ABV0@@Z" at ordinal 3 "MSIWmiAcpi.dll" contains export function called "?AddHWND@CMSIWmiAcpi@@QAEXPAUHWND__@@@Z" at ordinal 4 "MSIWmiAcpi.dll" contains export function called "?CallMSIWmiAcpiParser@CMSIWmiAcpi@@QAEXPAD0@Z" at ordinal 5 "MSIWmiAcpi.dll" contains export function called "?CompareCIMType@CMSIWmiAcpi@@QAE?AW4tag_CIMTYPE_ENUMERATION@@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z" at ordinal 6 "MSIWmiAcpi.dll" contains export function called "?FreeMethodWMI@CMSIWmiAcpi@@QAEXPAUMSI_METHOD_DEF@@@Z" at ordinal 7 "MSIWmiAcpi.dll" contains export function called "?GetOSVer@CMSIWmiAcpi@@IAEXXZ" at ordinal 8 "MSIWmiAcpi.dll" contains export function called "?GetPropertyInstanceNumber@CMSIWmiAcpi@@QAEHPA_WPAD00@Z" at ordinal 9 "MSIWmiAcpi.dll" contains export function called "?GetWMIErrMsg@CMSIWmiAcpi@@IAEXJPAD@Z" at ordinal 10 "MSIWmiAcpi.dll" contains export function called "?InitialCOM@CMSIWmiAcpi@@IAEXXZ" at ordinal 11 "MSIWmiAcpi.dll" contains export function called "?MSIWMIEvent@CMSIWmiAcpi@@QAE_NPA_WPAD00@Z" at ordinal 12 "MSIWmiAcpi.dll" contains export function called "?MethodWMI@CMSIWmiAcpi@@QAE_NPAUMSI_METHOD_DEF@@@Z" at ordinal 13 "MSIWmiAcpi.dll" contains export function called "?QueryWMIProperty@CMSIWmiAcpi@@QAE_NPA_WPAPA_WPAD200@Z" at ordinal 14 "MSIWmiAcpi.dll" contains export function called "?QueryWMIProperty@CMSIWmiAcpi@@QAE_NPA_WPAPA_WPAVCPtrArray@@PAD00@Z" at ordinal 15 "MSIWmiAcpi.dll" contains export function called "?SetWMIProperty@CMSIWmiAcpi@@QAE_NPA_WPAPA_WPAD200@Z" at ordinal 16 "MSIWmiAcpi.dll" contains export function called "?SetWMIProperty@CMSIWmiAcpi@@QAE_NPA_WPAPA_WPAVCPtrArray@@PAD00@Z" at ordinal 17 "MSIWmiAcpi.dll" contains export function called "?UnInitialCOM@CMSIWmiAcpi@@IAEXXZ" at ordinal 18 "MSIWmiAcpi.dll" contains export function called "IsMSIMethodWMI" at ordinal 19 "MSIWmiAcpi.dll" contains export function called "MSI_CallNamePipe" at ordinal 20 "MSIWmiAcpi.dll" contains export function called "MSI_CallNamePipe_CSharp" at ordinal 21 "Tobii.EyeX.Client.dll" contains export function called "??0IContext@EyeX@@QAE@ABV01@@Z" at ordinal 1 "Tobii.EyeX.Client.dll" contains export function called "??0IContext@EyeX@@QAE@XZ" at ordinal 2 "Tobii.EyeX.Client.dll" contains export function called "??0IInteractionLayer@EyeX@@QAE@ABV01@@Z" at ordinal 3 "Tobii.EyeX.Client.dll" contains export function called "??0IInteractionLayer@EyeX@@QAE@XZ" at ordinal 443:T69d,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "MSIService.exe.2424824512") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "MSIService.exe.2424824512") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "26690970989,3440,107,,GetActiveWindow,user32.dll,"252:03:07.703",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00003344.00000000.67508.00250000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")44:T6e0,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "MSIService.exe.2424824512") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")45:Td9d,Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKeyTransacted"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")46:T28b1,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000810070f4120095e15e77d0991800feffffffff2b62779a2a627744111a7200000000000000007cf212002c32e47518f31200c83a80778cf31200d58c7877c8f312005cf3120042a47677a80280779cf31200d2f47677080000006ef5767744f576770e2de42602000000341a1772000013005b511772020000000000000044111a7270c2280044111a720000000070c22800e0f31200086d627718816a77010000000000000000001772341a1772000013005b5117721c26810018268100b0f31200f0f3120070f4120091e11972f0e2ba54f4f31200c89f627744111a7200000000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008605e4267cd812006d82f1769ca0290004010000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006f006d002e00500072006f006700720061006d002e0055006e00770061006e007400650064002e0034003400360038002e00320034003300380034002e0035003200390030002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b6277e8466877d8ebb175ac01250000002500000000000000000026003e00030000000000000000000000000000000000000027003900030000000000000000000000486e250000000000200000000000000000000000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000038f0120030808d690000000000000200fcef1200fcef1200fcef12000200000002000000010042000500000000000000000000000000000060f11200547762773cf012000000000014000000bf776277000087690000000000008000bcf01200f000876900000000000000000000000000000000000000000000000000000000000000001200140014f21200e4f112000100000000000000ff2b6277307568770000000094012500000025000000000000000000230038003e00000000000000000000000000000000002000240004003e0000003cf1120020000000486e2500 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000250012000000aa0000000000000000000000d04a2700386b2500a06c2500e8bb2a005077250065007400e8de3a032e006500f0eb3a03e8bb2a00e9e96277e8bb2a0000000000aa00000014e03a034ce43a0300000000000000000000000000000000000000000000000080140000000025001c5c617760d87975ffffffff17000000c4df3a032400000003000000b4e43a03e0e93a034ce43a0386000000f0df3a0396ed62770abc2a00a06a38758600000014e03a034ce43a030000000086008800a06a387514e03a03916c38750abc2a00a06a3875a06a387584e43a0302020000 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003344) "setup.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b62771e706a749ce61003cc0150000000500000000000000000000000ffffd8020000000000000000000000000000180000000100a001d8020000601810033ce6100300e61003000000005200000050e61003feffffffd8e51003cf006377d600637716706a74520000002900000050e6100300000000ace5100395e15e77 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005000c080560000000000a20700a5340000c0e8825600383c5a00f8975800103900000000500040000000c0805600fce710030464627738015000e063627732726a740000000000005000c88056006dd19c751ef024276caef6760000000000000000d8bec275383c5a00182e50000100000000005000500150000c000000c880560002000000f8bf560040cb5500386b50003f0002000c0000007e000000020000000000ffff0b00000048cb55003f000000010000007874500010000000000000003f00000088df560044e81003cc416377f8bf560080000000f2030000ff2b6277 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b42f3a27acd910036d82f176f493580004010000 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005200500054006f006f006c0073005c00530043004d007800380036005c00730065007400750070002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b627796516a74d8ebb175ac01500000005000000000000000000019007f0049030000000000000000000000000000000000001a007a00490300000000000000000000486e500000000000200000000000000000000000 (UID: 00000000-00002444) "setup.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002444) "CloseSCM.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001512)47:T1127,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\SETUP\PRINTMASTER 16.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUALS\2000TBOX\2000.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\HANDBUCH\AVK INTERNETSECURITY 2006.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\INSTALL\DATA\SDREADME.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\HANDBUCH\AVK INTERNETSECURITY 2006.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\DOCUMENTATION\PN6README.DOC (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\DOCUMENTATION\PFSV401.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\DOCUMENTATION\DNMU.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUAL\EASYUN~1.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUALS\UI\UI_51.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\MANUALS\UNINSTAL\UI_51.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\DOCUMENTATION\APPMANAGER RESPONSE TIME\AM_AD-RT.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\DOCUMENTATION\APPMANAGER RESPONSE TIME\AM_AD-RT.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUAL\PEACHTREE OFFICE ACCOUNTING USER'S GUIDE.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\QUICKBOOKS LETTERS\EMPLOYEE LETTERS\SICK TIME.DOC (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\ENGLISH\DUAL-OPTION_USERMANUAL.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\EXTERNAL\JP\SD-JUKEBOXV6.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\DOCS\PFM WORKSTATION INSTALL.DOC (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\HELP\NN5QSG.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUAL\MAX2MAN.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MANUALS\FI2000.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\MSHOW\DOC\JPN\MEDIASHOW_UG.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\RED 2.0 RELEASE NOTES.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file \Device\HarddiskVolume2\Windows\Temp\DRPTools\MANUALS\WEBSCANX.PDF (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" opens a file %WINDIR%\Temp\DRPTools\SCMx86\SETUP\PRINTMASTER 16.PDF (UID: 00000000-00003344)48:T1d66,"Software\Microsoft\Windows\CurrentVersion" in Source: SecuriteInfo.com.Program.Unwanted.4468.24384.5290 "Software\Microsoft\VisualStudio\Setup" in Source: 14022-656-00C0AC0E "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 14022-905-00C1BCB3 "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 14022-880-00C137A1 "System\CurrentControlSet\Services\WmiAcpi" in Source: 17963-149-00401B70 "_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.70583.00BC2000.00000020.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" in Source: SCM_Notice.exe.3073113682 "SOFTWARE\Tobii\TobiiUpdater\TGX" in Source: 34145-19-100660A0 "01:\Software\Application\SBarIII\IsFirstBoot" in Source: 00000000-00004044-00000BC1-42821188 "02:\SYSTEM\CurrentControlSet\Services\WmiAcpi\MofImagePath" in Source: 00000000-00004044-00000BC1-42825415 "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.70574.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00001512.00000000.70574.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.70574.01D20000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001512.00000000.70574.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001512.00000000.70574.01D20000.00000004.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.70583.00BC2000.00000020.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00001512.00000000.70583.00BC2000.00000020.mdmp "KLM\Software\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00002444.00000000.67739.00840000.00000004.mdmp 00000000-00002444.00000002.70721.00840000.00000004.mdmp "Software\Microsoft\VisualStudio\Setup" in Source: 00000000-00002444.00000000.67739.00BF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002444.00000000.67739.00BF1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00002444.00000000.67739.00BF1000.00000020.mdmp "Software\[Manufacturer]\SBarIII" in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "SYSTEM\CurrentControlSet\Serviy" in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "Key="HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Client"" in Source: 00000000-00002444.00000002.70721.00C45000.00000002.mdmp "\pard\sb120\sa120\f1\fs20 Microsoft Corporation (or based on where you live, one of its affiliates) licenses this supplement to you. If you are licensed to use Microsoft Windows operating system software (for which this supplement is applicable) (the \ldblquote software\rdblquote ), you may use this supplement. You may not use it if you do not have a license for the software. You may use a copy of this supplement with each validly licensed copy of the software.\par" in Source: 00000000-00002444.00000002.70721.00C45000.00000002.mdmp "System\CurrentControlSet\Services\WmiAcpi" in Source: 00000000-00002636.00000000.70209.0041F000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00002636.00000000.70245.10119000.00000002.mdmp "Software\[Manufacturer]\SBarIII" in Source: 00000000-00003052.00000000.67908.003CC000.00000004.mdmp 00000000-00003052.00000001.69826.00370000.00000004.mdmp 00000000-00003052.00000002.70707.00370000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00003052.00000000.67908.00601000.00000020.mdmp "01:\Software\Application\SBarIII\IsFirstBoot" in Source: 00000000-00003052.00000001.69826.00370000.00000004.mdmp "02:\SYSTEM\CurrentControlSet\Services\WmiAcpi\MofImagePath" in Source: 00000000-00003052.00000001.69826.00370000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp "c:\windows\temp\drptools\scmx86\setup\software\aio_cdb_software.msi" in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003344.00000000.67508.00408000.00000002.mdmp "\pard\sb120\sa120\f1\fs20 Microsoft Corporation (or based on where you live, one of its affiliates) licenses this supplement to you. If you are licensed to use Microsoft Windows operating system software (for which this supplement is applicable) (the \ldblquote software\rdblquote ), you may use this supplement. You may not use it if you do not have a license for the software. You may use a copy of this supplement with each validly licensed copy of the software.\par" in Source: 00000000-00003344.00000000.67508.00414000.00000004.mdmp "Software\Microsoft\Windows\Curre" in Source: 00000000-00004044.00000000.67970.001C0000.00000004.mdmp 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp "00817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\Folders" in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiAcpi" in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\WmiAcpi" in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000001.69892.02050000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp "Software\[Manufacturer]\SBarIII" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp "Software\Classes" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Application\SBarIII" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp "\SYSTEM\CurrentControlSet\Services\WmiAcpi" in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp49:T8d6,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "MSIService.exe.2424824512") Found reference to API "LockResource" (Indicator: "LockResource"; File: "MSIService.exe.2424824512") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "MSIService.exe.2424824512") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "MSIService.exe.2424824512") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp")4a:Td00,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{56A9ABDD-3594-444A-A884-EBA90CACA87E}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{56A9ABDD-3594-444A-A884-EBA90CACA87E}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{EF104BD9-683C-4BF4-A5F5-78FBFCF2C93A}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{EF104BD9-683C-4BF4-A5F5-78FBFCF2C93A}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{475B3E82-4409-4364-992D-003C468E2036}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{475B3E82-4409-4364-992D-003C468E2036}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{35BF919E-0495-48DF-8E74-456384E34E74}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{35BF919E-0495-48DF-8E74-456384E34E74}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{307A29FF-AD8D-4ECC-8869-11273CDBF47D}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{307A29FF-AD8D-4ECC-8869-11273CDBF47D}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{0A1F2093-E180-4D30-B501-D62CDBB2DC2D}"; Value: "") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{0A1F2093-E180-4D30-B501-D62CDBB2DC2D}"; Value: "")4b:T617,"setup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "COMMENTS") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "CONTACT") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "DISPLAYVERSION") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "HELPLINK") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "HELPTELEPHONE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "INSTALLDATE") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0975A490-B40D-453C-9725-8ADC88A798AB}"; Key: "INSTALLLOCATION")4c:T12bd,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002444.00000001.69659.00500000.00000004.mdmp 00000000-00002444.00000002.70721.00500000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003344.00000000.67508.00250000.00000004.mdmp "\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "\programdata\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp 00000000-00004044.00000002.71810.001C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004044.00000001.69892.00810000.00000002.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004044.00000001.69892.00810000.00000002.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp 00000000-00004044.00000002.71810.0185C000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp "\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp 00000000-00004044.00000002.71810.017EB000.00000004.mdmp 00000000-00004044.00000002.71810.0185C000.00000004.mdmp4d:T6ad,Found reference to API "GetDC" (Indicator: "GetDC"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "26655916145,3440,3155,,CreateCompatibleBitmap,Gdi32.dll,"252:03:07.687",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003344.00000000.67508.00250000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")4e:T553,Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004044] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00004044] Dropped file: "66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E]- [targetUID: 00000000-00004044] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00004044] Dropped file: "66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E]- [targetUID: 00000000-00004044] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004044]4f:T43d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "MSIService.exe.2424824512") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp")50:T1af7,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\Temp\DRPTools\SCMx86\msiexec.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\Temp\DRPTools\SCMx86\setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 23344 bytes starting with PE header signature to file "C:\Program Files\SCM\System.Windows.Interactivity.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\EyeTracking\EyeXFramework.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 11264 bytes starting with PE header signature to file "C:\Program Files\SCM\MSIECO.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 8704 bytes starting with PE header signature to file "C:\Program Files\SCM\CloseSCM.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\SCM.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Windows\System32\DeviceCount.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 5120 bytes starting with PE header signature to file "C:\Program Files\SCM\WPFOSD.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\MSIWmiAcpi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 3584 bytes starting with PE header signature to file "C:\Windows\System32\msiapcfg.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 6656 bytes starting with PE header signature to file "C:\Program Files\SCM\EyeTracking\EyeTracking.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\SCM\EyeTracking\Tobii.EyeX.Client.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 6144 bytes starting with PE header signature to file "C:\Program Files\SCM\MSIODD.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\devcon.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 21504 bytes starting with PE header signature to file "C:\Program Files\SCM\MSIService.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\SCM\SCM_Notice.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...51:T4b0,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "MSIService.exe.2424824512") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")52:Td24,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "MSIService.exe.2424824512") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp")53:Ta82,Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalAnsi" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "OffsetOf" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "WPFOSD.dll" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "SCM_Notice.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "SCM_Notice.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForLastWin32Error" in "SCM_Notice.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "SCM_Notice.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalAnsi" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "SCM.exe" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "EyeXFramework.dll" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "MSIECO.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "MSIECO.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "MSIECO.dll"54:Tf15,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetFileAttributesTransactedA" (Indicator: "GetFileAttributes"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp")55:T5b5,"msiexec.exe" touched file "C:\Program Files\SCM\System.Windows.Interactivity.dll" "msiexec.exe" touched file "C:\Program Files\SCM\EyeTracking\EyeXFramework.dll" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO.dll" "msiexec.exe" touched file "C:\Program Files\SCM\CloseSCM.exe" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO\Office.eps" "msiexec.exe" touched file "C:\Program Files\SCM\SCM.exe" "msiexec.exe" touched file "C:\Program Files\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL" "msiexec.exe" touched file "C:\Program Files\SCM\WPFOSD.dll" "msiexec.exe" touched file "C:\Program Files\SCM\MSIWmiAcpi.dll" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO\Presentation.eps" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO\Movie.eps" "msiexec.exe" touched file "C:\Program Files\SCM\EyeTracking\Tobii.EyeX.Client.dll" "msiexec.exe" touched file "C:\Program Files\SCM\SCM.exe.config" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO\Gaming.eps" "msiexec.exe" touched file "C:\Program Files\SCM\MSIECO\TurboBattery.eps" "msiexec.exe" touched file "C:\Program Files\SCM\MSIODD.dll" "msiexec.exe" touched file "C:\Program Files\SCM\scm.ico" "msiexec.exe" touched file "C:\Program Files\SCM\devcon.dll" "msiexec.exe" touched file "C:\Program Files\SCM\MSIService.exe" "msiexec.exe" touched file "C:\Program Files\SCM\SCM_Notice.exe" "CloseSCM.exe" touched file "C:\Program Files\SCM\CloseSCM.exe.config"56:Ta9b,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Tobii.EyeX.Client.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "WPFOSD.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "SCM_Notice.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "devcon.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "SCM.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "DeviceCount.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "EyeXFramework.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MSIECO.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "CloseSCM.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "EyeTracking.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MSIODD.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msiapcfg.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "SETUP.EXE.65AE6164.bin" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Tobii.EyeX.Client.Net20.DLL" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT57:T6ad,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindFirstFileA" with parameter %WINDIR%\TEMP\DRPTools (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindFirstFileA" with parameter %WINDIR%\TEMP (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindFirstFileA" with parameter C:\Windows (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindFirstFileA" with parameter %WINDIR%\TEMP\DRPTools\SCMx86 (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindFirstFileW" with parameter %WINDIR%\TEMP\DRPTools\SCMx86\*.* (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindNextFileW" with parameter msiexec.exe (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindNextFileW" with parameter SCMx86Setup.msi (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "FindNextFileW" with parameter setup.exe (UID: 00000000-00003344) "msiexec.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\Certificates\* (UID: 00000000-00004044) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004044) "msiexec.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\CRLs\* (UID: 00000000-00004044) "msiexec.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\CTLs\* (UID: 00000000-00004044)58:T27bd,"36178ba9.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Create Time/Date: Mon Jun 21 07:00:00 1999 Name of Creating Application: Windows Installer Security: 1 Code page: 1252 Template: Intel;1033 Number of Pages: 200 Revision Number: {4DC21832-C6DB-40A5-80CC-1EA03B31F345} Title: SCM Setup Author: SCM Keywords: SCM Comments: SCM Number of Words: 2 Last Saved Time/Date: Fri Jan 22 05:46:57 2016 Last Printed: Fri Jan 22 05:46:57 2016"- Location: [%WINDIR%\Installer\36178ba9.msi]- [targetUID: 00000000-00004044] "MSIWmiAcpi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIWmiAcpi.dll]- [targetUID: 00000000-00002636] "Tobii.EyeX.Client.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\Tobii.EyeX.Client.dll]- [targetUID: 00000000-00004044] "WPFOSD.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\WPFOSD.dll]- [targetUID: 00000000-00004044] "SCM_Notice.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\SCM_Notice.exe]- [targetUID: 00000000-00004044] "devcon.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\devcon.dll]- [targetUID: 00000000-00004044] "SCM.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\SCM.exe]- [targetUID: 00000000-00004044] "DeviceCount.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\System32\DeviceCount.exe]- [targetUID: 00000000-00004044] "MSIService.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIService.exe]- [targetUID: 00000000-00004044] "_AD220580923AF41B2768B2.exe" has type "MS Windows icon resource - 15 icons 13x256 with PNG image data 256 x 0 8-bit/color RGBA non-interlaced 18505 planes 21060 bits/pixel 48x48 16 colors 4 bits/pixel"- Location: [%WINDIR%\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_AD220580923AF41B2768B2.exe]- [targetUID: 00000000-00004044] "EyeXFramework.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\EyeXFramework.dll]- [targetUID: 00000000-00004044] "System.Windows.Interactivity.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\System.Windows.Interactivity.dll]- [targetUID: 00000000-00004044] "MSIECO.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIECO.dll]- [targetUID: 00000000-00004044] "CloseSCM.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\CloseSCM.exe]- [targetUID: 00000000-00001512] "EyeTracking.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\EyeTracking.exe]- [targetUID: 00000000-00004044] "MSIODD.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\MSIODD.dll]- [targetUID: 00000000-00004044] "msiapcfg.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\msiapcfg.dll]- [targetUID: 00000000-00004044] "SCM.exe.config" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\SCM\SCM.exe.config]- [targetUID: 00000000-00004044] "SCM.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Fri Jan 22 12:46:56 2016 mtime=Mon Jan 22 12:07:26 2024 atime=Fri Jan 22 12:46:56 2016 length=298496 window=hide"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\SCM.lnk]- [targetUID: 00000000-00004044] "SCM.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Fri Jan 22 12:46:56 2016 mtime=Mon Jan 22 12:07:26 2024 atime=Fri Jan 22 12:46:56 2016 length=298496 window=hide"- Location: [%PUBLIC%\Desktop\SCM.lnk]- [targetUID: 00000000-00004044] "nsm87F.tmp" has type "data"- Location: [%TEMP%\nsm87F.tmp]- [targetUID: 00000000-00003344] "SETUP.EXE.65AE6164.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI90BB.tmp" has type "data"- Location: [%WINDIR%\Installer\MSI90BB.tmp]- [targetUID: 00000000-00004044] "MSI8AAF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI8AAF.tmp]- [targetUID: 00000000-00003600] "scm.ico" has type "MS Windows icon resource - 15 icons 256x256 16 colors with PNG image data 256 x 256 8-bit/color RGBA non-interlaced 4 bits/pixel 48x48 16 colors 4 bits/pixel"- Location: [%PROGRAMFILES%\SCM\scm.ico]- [targetUID: 00000000-00004044] "Tobii.EyeX.Client.Net20.DLL" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL]- [targetUID: 00000000-00004044] "36178ba8.rbs" has type "data"- Location: [C:\Config.Msi\36178ba8.rbs]- [targetUID: 00000000-00004044] "Presentation.eps" has type "MS Windows registry file NT/2000 or above"- Location: [%PROGRAMFILES%\SCM\MSIECO\Presentation.eps]- [targetUID: 00000000-00004044] "Office.eps" has type "MS Windows registry file NT/2000 or above"- Location: [%PROGRAMFILES%\SCM\MSIECO\Office.eps]- [targetUID: 00000000-00004044] "Movie.eps" has type "MS Windows registry file NT/2000 or above"- Location: [%PROGRAMFILES%\SCM\MSIECO\Movie.eps]- [targetUID: 00000000-00004044] "TurboBattery.eps" has type "MS Windows registry file NT/2000 or above"- Location: [%PROGRAMFILES%\SCM\MSIECO\TurboBattery.eps]- [targetUID: 00000000-00004044] "Gaming.eps" has type "MS Windows registry file NT/2000 or above"- Location: [%PROGRAMFILES%\SCM\MSIECO\Gaming.eps]- [targetUID: 00000000-00004044] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004044] "install.log" has type "data"- Location: [%TEMP%\VSD1510.tmp\install.log]- [targetUID: 00000000-00002444] "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00004044] "66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E]- [targetUID: 00000000-00004044] "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00004044] "66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E]- [targetUID: 00000000-00004044] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004044] "CFG8A02.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\CFG8A02.tmp]- [targetUID: 00000000-00003600] "SCMx86Setup.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Create Time/Date: Mon Jun 21 07:00:00 1999 Name of Creating Application: Windows Installer Security: 1 Code page: 1252 Template: Intel;1033 Number of Pages: 200 Revision Number: {4DC21832-C6DB-40A5-80CC-1EA03B31F345} Title: SCM Setup Author: SCM Keywords: SCM Comments: SCM Number of Words: 2 Last Saved Time/Date: Fri Jan 22 05:46:57 2016 Last Printed: Fri Jan 22 05:46:57 2016"- Location: [%WINDIR%\Temp\DRPTools\SCMx86\SCMx86Setup.msi]- [targetUID: 00000000-00003052] "36178ba4.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Create Time/Date: Mon Jun 21 07:00:00 1999 Name of Creating Application: Windows Installer Security: 1 Code page: 1252 Template: Intel;1033 Number of Pages: 200 Revision Number: {4DC21832-C6DB-40A5-80CC-1EA03B31F345} Title: SCM Setup Author: SCM Keywords: SCM Comments: SCM Number of Words: 2 Last Saved Time/Date: Fri Jan 22 05:46:57 2016 Last Printed: Fri Jan 22 05:46:57 2016"- Location: [%WINDIR%\Installer\36178ba4.msi]- [targetUID: 00000000-00004044] "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\DRPTools\SCMx86\setup.exe]- [targetUID: 00000000-00002444] "_7AFBD22CCAE1AC02EC4E31.exe" has type "MS Windows icon resource - 15 icons 13x256 with PNG image data 256 x 0 8-bit/color RGBA non-interlaced 18505 planes 21060 bits/pixel 48x48 16 colors 4 bits/pixel"- Location: [%WINDIR%\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe]- [targetUID: 00000000-00004044] "_853F67D554F05449430E7E.exe" has type "MS Windows icon resource - 15 icons 13x256 with PNG image data 256 x 0 8-bit/color RGBA non-interlaced 18505 planes 21060 bits/pixel 48x48 16 colors 4 bits/pixel"- Location: [%WINDIR%\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_853F67D554F05449430E7E.exe]- [targetUID: 00000000-00004044] "MSI8474.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI8474.tmp]- [targetUID: 00000000-00003600]59:T4c2,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"5a:T9f1,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"5b:T9ef,"Select * from" (Source: 00000000-00002636.00000000.70245.10119000.00000002.mdmp, Indicator: "select * from") "SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?" (Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp, Indicator: "select `msiassembly`.`attributes`, `msiassembly`.`file_application`, `msiassembly`.`file_manifest`, `component`.`keypath` from `msiassembly`, `component` where `msiassembly`.`component_` = `component`.`component` and `msiassembly`.`component_` = ?") "SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, Indicator: "select `filename`,`version`,`state`,`file`.`attributes`,`tempattributes`,`file`,`filesize`,`language`,`sequence`,`directory_`,`installed`,`action`,`component` from `file`,`component` where `component`=`component_` and `component_`=? and `directory_`=?") "SELECT `Value` FROM `MsiAssemblyName` WHERE `Component_` = ? AND (`Name` = 'Name' OR `Name` = 'NAME' OR `Name` = 'name')" (Source: 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp, Indicator: "select `value` from `msiassemblyname` where `component_` = ? and (`name` = 'name' or `name` = 'name' or `name` = 'name')"), "SELECT `Name` `Value` FROM `MsiAssemblyName` WHERE `Component_` = ? AND (`Name` <> 'Name' AND `Name` <> 'NAME' AND `Name` <> 'name')" (Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp, Indicator: "select `name` `value` from `msiassemblyname` where `component_` = ? and (`name` <> 'name' and `name` <> 'name' and `name` <> 'name')"), "SELECT `Cost` FROM `TypeLib` WHERE `Component_`=?" (Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp, Indicator: "select `cost` from `typelib` where `component_`=?"), "SELECT `Action` NULL `Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00004044.00000001.69892.017E0000.00000004.mdmp, Indicator: "select `action` null `condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`")5c:T7cb,Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "If this component is not "selected" for installation or removal, no action will be taken on the associated MoveFile entry" (Indicator: "MoveFile"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found reference to API "MoveFiles" (Indicator: "MoveFile"; Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.02050000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found reference to API "Integer value specifying the MoveFile operating mode, one of imfoEnum" (Indicator: "MoveFile"; Source: "00000000-00004044.00000001.69892.017E0000.00000004.mdmp, 00000000-00004044.00000002.71810.017EB000.00000004.mdmp") Found reference to API "Primary key that uniquely identifies a particular MoveFile record" (Indicator: "MoveFile"; Source: "00000000-00004044.00000001.69892.017E0000.00000004.mdmp, 00000000-00004044.00000002.71810.017EB000.00000004.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00004044.00000001.69892.017E0000.00000004.mdmp, 00000000-00004044.00000002.71810.017EB000.00000004.mdmp")5d:T3fc5,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 772d0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "KERNEL32" at base 75980000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75d80000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "OLE32.DLL" at base 77470000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "SETUPAPI.DLL" at base 772d0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "RPCRT4.DLL" at base 75e10000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "UXTHEME.DLL" at base 73fb0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "COMCTL32.DLL" at base 74350000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "ADVAPI32.DLL" at base 771c0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74150000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73dc0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 753d0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72170000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74a50000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 69ac0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fb0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "KERNEL32.DLL" at base 75980000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "OLEAUT32.DLL" at base 76e60000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "CLBCATQ.DLL" at base 75d80000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "NTMARTA.DLL" at base 749f0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75930000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "PROFAPI.DLL" at base 754e0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 69870000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "DWMAPI.DLL" at base 73dc0000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "IMM32.DLL" at base 77720000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77470000 "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75810000 "setup.exe" loaded module "COMCTL32.DLL" at base 74350000 "setup.exe" loaded module "ADVAPI32.DLL" at base 771c0000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77470000 "setup.exe" loaded module "CLBCATQ.DLL" at base 75d80000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75810000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75980000 "setup.exe" loaded module "IMM32.DLL" at base 77720000 "setup.exe" loaded module "VERSION.DLL" at base 74a50000 "setup.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "setup.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76f60000 "setup.exe" loaded module "SETUPAPI.DLL" at base 772d0000 "setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "setup.exe" loaded module "KERNEL32" at base 75980000 "setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 698f0000 "setup.exe" loaded module "UXTHEME.DLL" at base 73fb0000 "setup.exe" loaded module "SHELL32.DLL" at base 75ec0000 "setup.exe" loaded module "OLE32.DLL" at base 77470000 "setup.exe" loaded module "PROPSYS.DLL" at base 74150000 "setup.exe" loaded module "OLEAUT32.DLL" at base 76e60000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74150000 "setup.exe" loaded module "NTMARTA.DLL" at base 749f0000 "setup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75930000 "setup.exe" loaded module "PROFAPI.DLL" at base 754e0000 "setup.exe" loaded module "SECUR32.DLL" at base 75210000 "setup.exe" loaded module "RPCRT4.DLL" at base 75e10000 "setup.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75530000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 73a40000 "msiexec.exe" loaded module "RPCRT4.DLL" at base 75e10000 "msiexec.exe" loaded module "CLBCATQ.DLL" at base 75d80000 "msiexec.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75930000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6e950000 "msiexec.exe" loaded module "KERNEL32.DLL" at base 75980000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "msiexec.exe" loaded module "NTDLL.DLL" at base 775d0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76f00000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77470000 "msiexec.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "msiexec.exe" loaded module "ADVAPI32.DLL" at base 771c0000 "msiexec.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "msiexec.exe" loaded module "COMCTL32" at base 74350000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75980000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fb0000 "msiexec.exe" loaded module "RPCRTREMOTE.DLL" at base 75470000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ec0000 "msiexec.exe" loaded module "OLE32.DLL" at base 77470000 "msiexec.exe" loaded module "COMCTL32.DLL" at base 74350000 "msiexec.exe" loaded module "OLEAUT32.DLL" at base 76e60000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 771c0000 "msiexec.exe" loaded module "MSI.DLL" at base 6e950000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 75e10000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 75690000 "msiexec.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75930000 "msiexec.exe" loaded module "USERENV.DLL" at base 75690000 "msiexec.exe" loaded module "WINSTA.DLL" at base 75440000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70970000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75930000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733c0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "msiexec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "msiexec.exe" loaded module "KERNEL32" at base 75980000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 698f0000 "msiexec.exe" loaded module "SSPICLI.DLL" at base 75360000 "msiexec.exe" loaded module "WINTRUST.DLL" at base 756b0000 "msiexec.exe" loaded module "MSISIP.DLL" at base 69a20000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75540000 "msiexec.exe" loaded module "USER32.DLL" at base 770b0000 "msiexec.exe" loaded module "NCRYPT.DLL" at base 75010000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74bb0000 "msiexec.exe" loaded module "CRYPT32.DLL" at base 75540000 "msiexec.exe" loaded module "GPAPI.DLL" at base 74ab0000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75930000 "msiexec.exe" loaded module "CRYPTNET.DLL" at base 70970000 "msiexec.exe" loaded module "SENSAPI.DLL" at base 69a10000 "msiexec.exe" loaded module "SHLWAPI.DLL" at base 76f00000 "msiexec.exe" loaded module "WINHTTP.DLL" at base 70cf0000 "msiexec.exe" loaded module "WS2_32.DLL" at base 77180000 "msiexec.exe" loaded module "CREDSSP.DLL" at base 74ba0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ea0000 "msiexec.exe" loaded module "WSHTCPIP" at base 74940000 "msiexec.exe" loaded module "WSHIP6.DLL" at base 74e90000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 709e0000 "msiexec.exe" loaded module "IPHLPAPI.DLL" at base 74a30000 "msiexec.exe" loaded module "DHCPCSVC6.DLL" at base 73390000 "msiexec.exe" loaded module "NSI.DLL" at base 77740000 "msiexec.exe" loaded module "CFGMGR32.DLL" at base 75500000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75930000 "msiexec.exe" loaded module "PROFAPI.DLL" at base 754e0000 "msiexec.exe" loaded module "SETUPAPI.DLL" at base 772d0000 "msiexec.exe" loaded module "LINKINFO.DLL" at base 70770000 "msiexec.exe" loaded module "NTSHRUI.DLL" at base 72ef0000 "msiexec.exe" loaded module "SLC.DLL" at base 73550000 "msiexec.exe" loaded module "DNSAPI.DLL" at base 74d60000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74940000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e90000 "msiexec.exe" loaded module "RASADHLP.DLL" at base 71cf0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74a50000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 69570000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69210000 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "msiexec.exe" loaded module "VERSION.DLL" at base 74a50000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 69610000 "msiexec.exe" loaded module "NTMARTA.DLL" at base 749f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 775d0000 "msiexec.exe" loaded module "SHELL32.DLL" at base 75ec0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNELBASE.DLL" at base 75790000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 69a90000 "msiexec.exe" loaded module "DEVRTL.DLL" at base 74c50000 "msiexec.exe" loaded module "CABINET" at base 70d50000 "msiexec.exe" loaded module "PROPSYS.DLL" at base 74150000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74150000 "msiexec.exe" loaded module "SRVCLI.DLL" at base 750d0000 "msiexec.exe" loaded module "CSCAPI.DLL" at base 70b80000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6e950000 "MsiExec.exe" loaded module "MSI.DLL" at base 6e950000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI8474.TMP" at base 691d0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fb0000 "MsiExec.exe" loaded module "OLEAUT32.DLL" at base 76e60000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI8AAF.TMP" at base 691d0000 "MsiExec.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75930000 "MsiExec.exe" loaded module "CLBCATQ.DLL" at base 75d80000 "MsiExec.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "MsiExec.exe" loaded module "ADVAPI32.DLL" at base 771c0000 "MsiExec.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "MsiExec.exe" loaded module "RPCRTREMOTE.DLL" at base 75470000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77470000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 75e10000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 771c0000 "MSIService.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fb0000 "MSIService.exe" loaded module "RPCRT4.DLL" at base 75e10000 "MSIService.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "MSIService.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "MSIService.exe" loaded module "KERNEL32" at base 75980000 "MSIService.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "CloseSCM.exe" loaded module "SHLWAPI.DLL" at base 76f00000 "CloseSCM.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "CloseSCM.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "CloseSCM.exe" loaded module "VERSION.DLL" at base 74a50000 "CloseSCM.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "CloseSCM.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "CloseSCM.exe" loaded module "KERNEL32" at base 75980000 "CloseSCM.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 686c0000 "CloseSCM.exe" loaded module "USER32.DLL" at base 770b0000 "CloseSCM.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "CloseSCM.exe" loaded module "MSCOREE.DLL" at base 69250000 "CloseSCM.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "CloseSCM.exe" loaded module "RPCRT4.DLL" at base 75e10000 "CloseSCM.exe" loaded module "KERNEL32.DLL" at base 75980000 "CloseSCM.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67200000 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "CloseSCM.exe" loaded module "OLE32.DLL" at base 77470000 "CloseSCM.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "CloseSCM.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6e490000 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6cc00000 "CloseSCM.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 667a0000 "CloseSCM.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 665f0000 "CloseSCM.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65780000 "CloseSCM.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 65650000 "CloseSCM.exe" loaded module "ADVAPI32.DLL" at base 771c0000 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "CloseSCM.exe" loaded module "NTDLL.DLL" at base 775d0000 "CloseSCM.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6e400000 "CloseSCM.exe" loaded module "OLEAUT32.DLL" at base 76e60000 "CloseSCM.exe" loaded module "GDI32.DLL" at base 758e0000 "CloseSCM.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77720000 "CloseSCM.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 698f00005e:Tb6d,Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "+ncalrpc:[OLE54DE65FCF6724D5ABA17C63F953B]" (Indicator: "ncalrpc"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found string "B+ncalrpc:[OLE9696FE3EA0BC48D1B83E5D278F59]" (Indicator: "ncalrpc"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "+ncalrpc:[OLE9696FE3EA0BC48D1B83E5D278F59]" (Indicator: "ncalrpc"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "B+ncalrpc:[OLE9696FE3EA0BC48D1B83E5D278F59]" (Indicator: "ncalrpc"; Source: "00000000-00003600.00000000.69612.00270000.00000004.mdmp, 00000000-00003600.00000001.70692.00270000.00000004.mdmp") Found string "+ncalrpc:[OLE507A4A9B0493440D839168A320A6]" (Indicator: "ncalrpc"; Source: "00000000-00003600.00000000.69612.00270000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003600.00000000.69612.00270000.00000004.mdmp") Found string "+ncalrpc:[OLE9696FE3EA0BC48D1B83E5D278F59]" (Indicator: "ncalrpc"; Source: "00000000-00003600.00000000.69612.00270000.00000004.mdmp, 00000000-00003600.00000001.70692.00270000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found string "+ncalrpc:[OLE9696FE3EA0BC48D1B83E5D278F59]" (Indicator: "ncalrpc"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found string "+ncalrpc:[OLE54DE65FCF6724D5ABA17C63F953B]" (Indicator: "ncalrpc"; Source: "00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp") Found string "+ncalrpc:[OLE507A4A9B0493440D839168A320A6]" (Indicator: "ncalrpc"; Source: "00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp")5f:T3cfa,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290" file has an entrypoint instructions - "sub esp, 0x184,push ebx,push esi,push edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x18], ebx,mov dword ptr [esp + 0x10], 0x40a130,mov dword ptr [esp + 0x20], ebx,mov byte ptr [esp + 0x14], 0x20,call dword ptr [0x4080a8],call dword ptr [0x4080a4],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x44772c], eax,je 0x40335f,push ebx,call 0x406431,cmp eax, ebx,je 0x40335f,push 0xc00,call eax,mov esi, 0x408298,push esi,call 0x4063c3,push esi,call dword ptr [0x4080a0]," "MSIWmiAcpi.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100f5fba,call 0x100ff9e5,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100f5eb4,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,push esi,mov esi, dword ptr [0x10119218],push edi,push dword ptr [0x10165aac],call esi,push dword ptr [0x10165aa8],mov ebx, eax,mov dword ptr [ebp - 4], ebx,call esi,mov esi, eax,cmp esi, ebx,jb 0x100f607c,mov edi, esi,sub edi, ebx,lea eax, [edi + 4],cmp eax, 4,jb 0x100f607c,push ebx,call 0x100f705d," "Tobii.EyeX.Client.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1006ac29,call 0x1006b0b1,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1006ac3e,add esp, 0xc,pop ebp,ret 0xc,push 0x10,push 0x10085c50,call 0x1006aec0,xor eax, eax,inc eax,mov esi, eax,mov dword ptr [ebp - 0x1c], esi,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,mov edi, dword ptr [ebp + 0xc],mov dword ptr [0x100a7020], edi,mov dword ptr [ebp - 4], eax,test edi, edi,jne 0x1006ac73,cmp dword ptr [0x100b51d0], edi,je 0x1006ad47,cmp edi, eax,je 0x1006ac7c,cmp edi, 2,jne 0x1006acb4," "WPFOSD.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "SCM_Notice.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "devcon.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000fb8c,call 0x1000ff9b,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000fa4b,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push esi,push 0x17,call 0x1002aa4c,test eax, eax,je 0x1000fbbc,mov ecx, dword ptr [ebp + 8],int 0x29,xor esi, esi,lea eax, [ebp - 0x324],push 0x2cc,push esi,push eax,mov dword ptr [0x1003d744], esi,call 0x10014400,add esp, 0xc,mov dword ptr [ebp - 0x274], eax," "SCM.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DeviceCount.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "MSIService.exe" file has an entrypoint instructions - "call 0x4145e9,jmp 0x40d148,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,mov eax, dword ptr [ebp + 0xc],add eax, 0xc,mov dword ptr [ebp - 4], eax,mov ebx, dword ptr fs:[0],mov eax, dword ptr [ebx],mov dword ptr fs:[0], eax,mov eax, dword ptr [ebp + 8],mov ebx, dword ptr [ebp + 0xc],mov ebp, dword ptr [ebp - 4],mov esp, dword ptr [ebx - 4],jmp eax,pop ebx,leave ,ret 8,pop eax,pop ecx,xchg dword ptr [esp], eax,jmp eax,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ecx,push ebx,push esi,push edi,mov esi, dword ptr fs:[0],mov dword ptr [ebp - 4], esi,mov dword ptr [ebp - 8], 0x40d308,push 0,push dword ptr [ebp + 0xc]," "EyeXFramework.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "MSIECO.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "CloseSCM.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "EyeTracking.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "MSIODD.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "msiapcfg.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "SETUP.EXE.65AE6164.bin" file has an entrypoint instructions - "call 0x4333e4,jmp 0x42e3cf,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,pop ebp,jmp 0x42fa9e,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov dx, word ptr [ebp + 0xc],jmp 0x42e576,cmp cx, dx,je 0x42e585,add eax, 2,movzx ecx, word ptr [eax],test cx, cx,jne 0x42e56e,cmp word ptr [eax], dx,je 0x42e585,xor eax, eax,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push edi,push esi,mov esi, dword ptr [ebp + 0xc],mov ecx, dword ptr [ebp + 0x10],mov edi, dword ptr [ebp + 8],mov eax, ecx,mov edx, ecx,add eax, esi," "Tobii.EyeX.Client.Net20.DLL" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"60:Tec6,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "MSIService.exe.2424824512") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "MSIService.exe.2424824512") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "MSIService.exe.2424824512") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "MSIService.exe.2424824512") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")61:T580,"msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")62:T6ea,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "\Device\HarddiskVolume2\Windows\Temp" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "C:\Windows\Temp\DRPTools\SCMx86\SCMx86Setup.msi" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "C:\Windows\Temp\DRPTools\SCMx86\msiexec.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "C:\Windows\Temp\DRPTools\SCMx86\setup.exe" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "\Device\HarddiskVolume2\Windows\Temp\DRPTools" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "\Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "setup.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "setup.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "msiexec.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\system32\ar-SA\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\bg-BG\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\cs-CZ\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\da-DK\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\de-DE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\el-GR\sxs.DLL.mui"63:T4ad,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00004044-00000C26-32669980") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004044-00000C26-39155968") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004044-00000C26-40241373") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004044-00000C26-40346393") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004044-00000C26-40346393") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004044-00000C26-40346393") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004044-00000C26-45387829") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004044-00000C26-45387829") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004044-00000C26-45539106") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004044-00000C26-45540787")64:T782,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "MSIService.exe.2424824512") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "MSIService.exe.2424824512") Found reference to API "2344,3024,,RtlGetVersion,NTDLL.dl" (Indicator: "GetVersion"; Source: "00000000-00001512.00000000.70583.00480000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")65:T48f,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "MSIODD.dll.1245732750") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "SCM_Notice.exe.3073113682") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateFileTransactedA" (Indicator: "CreateFile"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")66:T435,Found reference to API "OpenSCManager failed - %s" (Indicator: "OpenSCManager"; File: "00000000-00002636.00000000.70245.00401000.00000020.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; File: "MSIService.exe.2424824512") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "MSIService.exe.2424824512") Found reference to API "OpenSCManager failed - %s" (Indicator: "OpenSCManager"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp")67:T54a,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "MSIService.exe.2424824512") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")68:T69a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "MSIService.exe.2424824512") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")69:T599,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MSIWmiAcpi.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Tobii.EyeX.Client.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WPFOSD.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SCM_Notice.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "devcon.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SCM.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "DeviceCount.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MSIService.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "EyeXFramework.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MSIECO.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "CloseSCM.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "EyeTracking.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MSIODD.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msiapcfg.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SETUP.EXE.65AE6164.bin" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Tobii.EyeX.Client.Net20.DLL" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE6a:T660,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "Unable to run create process. GetLastError returned: %d" (Indicator: "GetLastError"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "MSIService.exe.2424824512") Found reference to API "Unable to run create process. GetLastError returned: %d" (Indicator: "GetLastError"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")6b:T7e0,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADOBE") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPMGMT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPRAISER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BOOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT2") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CODEINTEGRITY") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM")6c:T51b,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2437 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 22 Jan 2024 12:37:18 GMT Last-Modified: Mon 22 Jan 2024 11:56:41 GMT Server: ECAcc (sac/251E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 344 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 22 Jan 2024 12:37:19 GMT Last-Modified: Mon 22 Jan 2024 12:31:35 GMT Server: ECAcc (sac/2527) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145AC4B97B2A0AA3A5EA7103C060F92DF665750E58180F32.......6d:T44d,"MSIWmiAcpi.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "Tobii.EyeX.Client.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "WPFOSD.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "SCM_Notice.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "devcon.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "SCM.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "DeviceCount.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MSIService.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "EyeXFramework.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MSIECO.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "CloseSCM.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "EyeTracking.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MSIODD.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "SETUP.EXE.65AE6164.bin" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "Tobii.EyeX.Client.Net20.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"6e:T7bc,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001512.00000000.70574.01D20000.00000004.mdmp, 00000000-00001512.00000000.70583.00480000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")6f:T4cf,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "Unable to set RunOnce key. RegSetValue failed with error code '%d'" (Indicator: "RegSetValue"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "Unable to set RunOnce key. RegSetValue failed with error code '%d'" (Indicator: "RegSetValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")70:T856,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 96%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 97%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 98%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "&Close" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "--= Copyright" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Output folder: %WINDIR%\TEMP\DRPTools\SCMx86" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 88%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 89%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 90%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 91%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 92%" - (UID: 00000000-00003344) "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" called "GetWindowTextW" with parameter "Extract: SCMx86Setup.msi... 93%" - (UID: 00000000-00003344)71:T671,Observed unmanaged function "CallNamedPipe" in "WPFOSD.dll" Observed unmanaged function "SHAppBarMessage" in "WPFOSD.dll" Observed unmanaged function "FindWindow" in "WPFOSD.dll" Observed unmanaged function "SendMessage" in "WPFOSD.dll" Observed unmanaged function "RegisterWindowMessage" in "WPFOSD.dll" Observed unmanaged function "SetCursorPos" in "WPFOSD.dll" Observed unmanaged function "devcon" in "WPFOSD.dll" Observed unmanaged function "wlan_control" in "WPFOSD.dll" Observed unmanaged function "GetWindowLong" in "WPFOSD.dll" Observed unmanaged function "SetWindowLong" in "WPFOSD.dll" Observed unmanaged function "SHGetSpecialFolderPath" in "WPFOSD.dll" Observed unmanaged function "CreateFileW" in "SCM_Notice.exe" Observed unmanaged function "DeviceIoControl" in "SCM_Notice.exe" Observed unmanaged function "CloseHandle" in "SCM_Notice.exe" Observed unmanaged function "keybd_event" in "SCM.exe" Observed unmanaged function "EnumDisplaySettings" in "SCM.exe" Observed unmanaged function "ChangeDisplaySettingsEx" in "SCM.exe" Observed unmanaged function "EnumDisplayDevices" in "SCM.exe" Observed unmanaged function "SystemParametersInfo" in "SCM.exe" Observed unmanaged function "SetupDiClassGuidsFromNameA" in "DeviceCount.exe" Observed unmanaged function "SetupDiGetClassDevsA" in "DeviceCount.exe" Observed unmanaged function "SetupDiEnumDeviceInfo" in "DeviceCount.exe" Observed unmanaged function "SetupDiDestroyDeviceInfoList" in "DeviceCount.exe" Observed unmanaged function "SetupDiGetDeviceRegistryPropertyA" in "DeviceCount.exe" Observed unmanaged function "SetProcessDPIAware" in "EyeXFramework.dll"72:T5d2,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "SecuriteInfo.com.Program.Unwanted.4468.24384.5290") Found reference to API "Unable to set RunOnce key. RegCreateKey failed with error code '%d'" (Indicator: "RegCreateKey"; File: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "Unable to set RunOnce key. RegCreateKey failed with error code '%d'" (Indicator: "RegCreateKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002444.00000000.67739.00BF1000.00000020.mdmp") Found reference to API "RegCreateKeyTransactedA" (Indicator: "RegCreateKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegCreateKeyTransactedA" (Indicator: "RegCreateKeyTransacted"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002636.00000000.70245.10119000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00003052.00000000.67908.00601000.00000020.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003344.00000000.67508.00408000.00000002.mdmp")73:Tb70,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe.Local\" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\SCMx86\SCMx86Setup.msi" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\laplink.ico" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\TEMP\DRPTools\AILOGO.ICO" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash8.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash8b.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9b.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9c.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9d.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9e.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash9f.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10a.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10b.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10c.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10d.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10e.ocx" "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" trying to access non-existent file "C:\Windows\system32\Macromed\Flash\Flash10f.ocx"74:T43a,"msiexec.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003052) "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\" (UID: 00000000-00004044), "msiexec.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004044), "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Installer\SourceHash{0975A490-B40D-453C-9725-8ADC88A798AB}" (UID: 00000000-00004044) "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\Users\HAPUBWS\AppData\Local\Temp\~DF1A7FDE6CF9886D3C.TMP" (UID: 00000000-00004044), "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Installer\MSI90BB.tmp" (UID: 00000000-00004044) "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Installer\36178ba9.msi" (UID: 00000000-00004044), "msiexec.exe" called an API "AdjustTokenPrivileges"on file: \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A896E75C4828C924F986BC4F4E78A17B" (UID: 00000000-00004044) "msiexec.exe" called an API "AdjustTokenPrivileges"on file: C:\Config.Msi\36178ba8.rbs" (UID: 00000000-00004044)75:T131e,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001512.00000000.70583.00480000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\DRPTools\SCMx86\setup.exe" (Indicator: "\Device\"; Source: "00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string "indows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002444.00000002.70721.00500000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\SCM\MSIService.exe" (Indicator: "\Device\"; Source: "00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\SCM\MSIService.exe" (Indicator: "\Device\"; Source: "00000000-00002636.00000000.70245.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00003052.00000000.67908.00370000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003052.00000002.70707.00370000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003344.00000000.67508.00250000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003344.00000000.67508.00250000.00000004.mdmp")76:T58d,"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MsiExec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")77:T736,"msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"36178ba4.msi","sha256":"4a846fe82a937531ad8d929c3eed01f1f7d5bc5b45225e5fa75d01a6f345c1da","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E","sha256":"0e8d81ab9fe3a1eedf909f1edb7900ca6ccf9745d11247f5ead8882384c2332e","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Tobii.EyeX.Client.Net20.DLL","sha256":"cecd29ca98d95065a834ffd02a067217484d201d0ec8d932f80e64c3348e7d35","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Tobii.EyeX.Client.dll","sha256":"a24f5d5ce05ef3fb07e7aa426b37ad82704c754bae4d79e1596a1e16cf0dbe77","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Movie.eps","sha256":"92d1b1cef734f61b75436fe38e15bcefcc5ce4dc320da3fcf12d91fe3f713df2","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"EyeTracking.exe","sha256":"d70b7a81d257e047a2a640139f24e7623cb21190085bcd7415f07f783e77c732","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"MSIWmiAcpi.dll","sha256":"feb03b0e9402c7fb2cf42932e45c6e981a508fd907c2790df592d9af2c799364","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"System.Windows.Interactivity.dll","sha256":"dde4369e03590e17b770c41d5c9fca433b021ff367ff7a60598d570bc7d12f05","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"WPFOSD.dll","sha256":"b445c4f23f40cdcfaac9594e4cea1cd6b9eb371afe76541b2147632a1235cc6f","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"_AD220580923AF41B2768B2.exe","sha256":"f072de7b5918e6c828a8713df4e53c8c0003fcdee6be4404a0f758b38369539c","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"SCMx86Setup.msi","sha256":"4a846fe82a937531ad8d929c3eed01f1f7d5bc5b45225e5fa75d01a6f345c1da","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Office.eps","sha256":"57c05fd61933d6aa55dd9148745b23ea6266cc39bb0be7ed87fdcae62f12fe19","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Presentation.eps","sha256":"6ed6874610774f9089f50de128eedf927f87086c3663c262fe57c323650b6c0a","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"TurboBattery.eps","sha256":"1b3ad082b1cdf7186eb490ce208b29b02c94af8609bfe0a6024b44c7e889f48e","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"36178ba9.msi","sha256":"4a846fe82a937531ad8d929c3eed01f1f7d5bc5b45225e5fa75d01a6f345c1da","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"SETUP.EXE.65AE6164.bin","sha256":"f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"setup.exe","sha256":"f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CloseSCM.exe","sha256":"fb1f08fb9992ecbb977c21ba40a7a2dc16a098fcc8d78d19327e48b88386ff7e","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"MSIECO.dll","sha256":"fac198dea9e50f835f2fb306a408dff6d2769054f2526b40167556b8db69ed09","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"SCM_Notice.exe","sha256":"958ac627d19225d20fae99a375856e2367367db9c880821ada57dead931e3665","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"_853F67D554F05449430E7E.exe","sha256":"f072de7b5918e6c828a8713df4e53c8c0003fcdee6be4404a0f758b38369539c","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"MSIODD.dll","sha256":"3c87bcd6efca42ce2788a698b2d8a998a7518d8df1ac5dad5a1d548094720cdf","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"MSIService.exe","sha256":"455175332156939b3cda4511a2a6c213abbfdb85eeeca98b6ab014c994f532c4","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"_7AFBD22CCAE1AC02EC4E31.exe","sha256":"f072de7b5918e6c828a8713df4e53c8c0003fcdee6be4404a0f758b38369539c","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"DeviceCount.exe","sha256":"5db7f0c15f546489b01350824892b7dedeae2b7eab717ce8af6e8ac4d742e82b","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"SCM.lnk","sha256":"3c12772606acd70206d70314ca8d374b066778ab436fff00b507b5b697d3da47","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sha256":"bf05332e167cbb11968b3f995c822a70d395978a0777ce9477d09934b697f01f","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Gaming.eps","sha256":"5be283e351e49a8b27ce52d53f6294011e9a0d952c0fd18d5e59716771db9e9a","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"SCM.exe","sha256":"9d88d81ba91b75cfdfc75f7529fbaeaea40cb962a25e1d1986d5906cc745a140","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"msiapcfg.dll","sha256":"4ba1cbb8fd687a916ccb7898b7f8528717033a39886577de7f269cfe2b49a65e","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"EyeXFramework.dll","sha256":"7ed1cc7c4eba0619d80864eb8c1c9ce86fc64f2b26aa1022b87f423cc5f318f5","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"},{"name":"devcon.dll","sha256":"76133b620cd01d967099e634b48def1cec2f450b0c129ee05fa5f16869cfe696","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%PROGRAMFILES%\\SCM\\MSIECO\\Presentation.eps","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\36178ba4.msi","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\MSIECO\\Office.eps","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\MSIECO\\Movie.eps","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\nsm87F.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%SAMPLEDIR%\\Windows","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\~DF1A7FDE6CF9886D3C.TMP","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\EyeTracking\\Tobii.EyeX.Client.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\CFG8A02.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"C:\\Config.Msi\\MSI9B89.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\CloseSCM.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\msiapcfg.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\MSI8474.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\SourceHash{0975A490-B40D-453C-9725-8ADC88A798AB}","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\36178ba9.msi","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\SCM.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%SAMPLEDIR%\\ProgramData","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\DRPTools\\SCMx86\\setup.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\DRPTools","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\VSD1510.tmp\\install.log","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\VSD1510.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_DDF7F4EA9BCDF4EC9C9A02833596761E","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\nsg85E.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\DRPTools\\SCMx86\\SCMx86Setup.msi","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%TEMP%\\~DF93150C9C62F251DC.TMP","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\MSIECO.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\EyeTracking\\Tobii.EyeX.Client.Net20.DLL","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\WPFOSD.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\EyeTracking\\EyeTracking.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\System.Windows.Interactivity.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\MSI8AAF.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"C:\\Config.Msi\\36178ba8.rbs","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\DeviceCount.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\DRPTools\\SCMx86\\msiexec.exe","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\DRPTools\\SCMx86","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\36178ba7.ipi","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%WINDIR%\\Installer\\MSI90BB.tmp","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\EyeTracking\\EyeXFramework.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\SCM\\MSIWmiAcpi.dll","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"Global\\_MSIExecute","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"192.229.211.108","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"192.229.211.108","country":"United States","domain":"ocsp.digicert.com","registrar_creation_date":"1996-12-02T00:00:00+00:00","registrar_name":"GODADDY.COM, LLC","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_organization":"DigiCert, Inc.","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"ttl":19625}],"http_requests":[{"header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D"},{"header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"}]},"process_activity":{"all_imported_dlls":["sfc.dll","RpcRtRemote.dll","user32.dll","winsta.dll","netapi32.dll","System.ni.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ucrtbase_clr0400.dll","devobj.dll","sfc_os.dll","MSIWmiAcpi.dll","devrtl.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mswsock.dll","srvcli.dll","rasadhlp.dll","version.dll","mscorlib.ni.dll","setupapi.dll","ncrypt.dll","vcruntime140_clr0400.dll","dnsapi.dll","WSHTCPIP.DLL","gdi32.dll","iertutil.dll","propsys.dll","msimg32.dll","msimsg.dll","winhttp.dll","msctf.dll","ntdll.dll","fltLib.dll","oleaccrc.dll","ntmarta.dll","usp10.dll","rsaenh.dll","comctl32.dll","wintrust.dll","wkscli.dll","clbcatq.dll","normaliz.dll","riched20.dll","oleacc.dll","winmm.dll","lpk.dll","profapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ole32.dll","RstrtMgr.dll","System.Drawing.ni.dll","winnsi.dll","rpcss.dll","MSIECO.dll","samcli.dll","ntshrui.dll","cscapi.dll","uxtheme.dll","cryptnet.dll","AcGenral.dll","shell32.dll","wshqos.dll","VxSSL32.dll","netutils.dll","bcrypt.dll","nsi.dll","msacm32.dll","comdlg32.dll","IPHLPAPI.DLL","api-ms-win-downlevel-ole32-l1-1-0.dll","credssp.dll","oleaut32.dll","slc.dll","api-ms-win-downlevel-version-l1-1-0.dll","webio.dll","wininet.dll","shfolder.dll","crypt32.dll","rpcrt4.dll","AcLayers.dll","gpapi.dll","nlssorting.dll","userenv.dll","api-ms-win-core-xstate-l2-1-0.dll","cfgmgr32.dll","cabinet.dll","Wldap32.dll","urlmon.dll","dhcpcsvc.dll","SensApi.dll","mpr.dll","fusion.dll","clr.dll","FWPUCLNT.DLL","System.Management.ni.dll","cryptsp.dll","dhcpcsvc6.dll","KernelBase.dll","apphelp.dll","WPFOSD.dll","wship6.dll","advapi32.dll","msi.dll","sxs.dll","kernel32.dll","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","msasn1.dll","mscoreei.dll","sspicli.dll","ws2_32.dll","secur32.dll","msvcrt.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","System.Windows.Forms.ni.dll","mscoree.dll","linkinfo.dll","sechost.dll","bcryptprimitives.dll","Tobii.EyeX.Client.Net20.DLL","clrjit.dll","GdiPlus.dll","dwmapi.dll","imm32.dll"],"processes":[{"command_line":"","icon":"$22","name":"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe","normalized_path":"C:\\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe","pid":3344,"ppid":0,"sha256":"83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0","uid":"00000000-00003344"},{"command_line":"/quiet /norestart","name":"setup.exe","normalized_path":"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\setup.exe","parent_uid":"00000000-00003344","pid":2444,"ppid":3344,"sha256":"f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6","uid":"00000000-00002444"},{"command_line":"-I \"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\SCMx86Setup.msi\" /quiet /norestart","name":"msiexec.exe","normalized_path":"%WINDIR%\\system32\\msiexec.exe","parent_uid":"00000000-00002444","pid":3052,"ppid":2444,"sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","uid":"00000000-00003052"},{"command_line":"/V","icon":"$23","name":"msiexec.exe","normalized_path":"%WINDIR%\\system32\\msiexec.exe","pid":4044,"ppid":0,"sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","uid":"00000000-00004044"},{"command_line":"-Embedding A4ADF456DC577729D946C95EA899A3B2","name":"MsiExec.exe","normalized_path":"%WINDIR%\\system32\\MsiExec.exe","parent_uid":"00000000-00004044","pid":3600,"ppid":4044,"sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","uid":"00000000-00003600"},{"command_line":"-install","name":"MSIService.exe","normalized_path":"%PROGRAMFILES%\\SCM\\MSIService.exe","parent_uid":"00000000-00004044","pid":2636,"ppid":4044,"sha256":"455175332156939b3cda4511a2a6c213abbfdb85eeeca98b6ab014c994f532c4","uid":"00000000-00002636"},{"command_line":"install","name":"CloseSCM.exe","normalized_path":"%PROGRAMFILES%\\SCM\\CloseSCM.exe","parent_uid":"00000000-00004044","pid":1512,"ppid":4044,"sha256":"fb1f08fb9992ecbb977c21ba40a7a2dc16a098fcc8d78d19327e48b88386ff7e","uid":"00000000-00001512"},{"command_line":"","icon":"$24","name":"MSIService.exe","normalized_path":"%PROGRAMFILES%\\SCM\\MSIService.exe","pid":2560,"ppid":0,"sha256":"455175332156939b3cda4511a2a6c213abbfdb85eeeca98b6ab014c994f532c4","uid":"00000000-00002560"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2024-01-22T12:34:18+00:00","contacted_countries":["USA"],"environment_description":"Windows 7 32 bit (HWP Support)","environment_id":110,"id":"65ae60c9fe68a40981022c25","indicators_count":{"informative":239,"malicious":5,"suspicious":58},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"SecuriteInfo.com.Program.Unwanted.4468.24384.5290","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":2,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":33,"files_deleted_count":0,"files_written_count":56,"http_requests_count":2,"imported_dlls_count":124,"injected_processes_count":0,"mutex_created_count":7,"process_count":8,"registry_keys_created_count":3,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"script_calls_count":0,"spawned_processes_count":8}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Win/grayware_confidence_70%"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"details_count":3,"name":"Persistence","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Queries the installation properties of user installed products"}],"details_count":5,"name":"Fingerprint","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":5,"name":"Evasive","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"details":[{"detail":"Tries to access unusual system drive letters"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to access gaming information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Office Application Startup"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Destruction"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Search Order Hijacking"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Msiexec"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Discovery","technique":"Peripheral Device Discovery"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"$25","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$27","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: SecuriteInfo.com.Program.Unwanted.4468.24384.5290]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: MSIWmiAcpi.dll]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: devcon.dll]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: MSIService.exe]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".text\n .rsrc\n .text\n .rsrc\n .text\n .rsrc\n .text\n .rsrc with unusual entropies 7.6113349574\n 7.60886946566\n 7.69447694779\n 7.61081863311\n 7.38827301701\n 7.6105918105\n 7.85273864923\n 7.85937675072","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"CallNamedPipeA\" (Indicator: \"CallNamedPipe\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 192.229.211.108 on port 80 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$29","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003052)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004044)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004044)\n \"MsiExec.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003600)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-269","level":"informative","mitre_attack_id":"T1564","name":"Contains reference to method used by Windows shell items (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$2a","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68A60000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 682B0000\n \"CloseSCM.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 67F10000\n \"CloseSCM.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 686C0000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2b","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" wrote 1500 bytes to a remote process \"C:\\Windows\\Temp\\DRPTools\\SCMx86\\setup.exe\" (Handle: 428)\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\Temp\\DRPTools\\SCMx86\\setup.exe\" (Handle: 428)\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\Temp\\DRPTools\\SCMx86\\setup.exe\" (Handle: 428)\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\Temp\\DRPTools\\SCMx86\\setup.exe\" (Handle: 428)\n \"setup.exe\" wrote 1500 bytes to a remote process \"C:\\Windows\\System32\\msiexec.exe\" (Handle: 584)\n \"setup.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\msiexec.exe\" (Handle: 584)\n \"setup.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\msiexec.exe\" (Handle: 584)\n \"setup.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\msiexec.exe\" (Handle: 584)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004044)","id":"api-149","level":"informative","mitre_attack_id":"T1614.001","name":"Calls an API typically used to retrieve default language settings","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2c","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2d","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$2f","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$30","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenService failed - %s\" (Indicator: \"OpenService\"; File: \"00000000-00002636.00000000.70245.00401000.00000020.mdmp\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"OpenService failed - %s\" (Indicator: \"OpenService\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00002636.00000000.70245.00401000.00000020.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"150016003ccad26c@ADVAPI32.dll\"\n \"0e000f00eccad26c@ADVAPI32.dll\"\n \"0e000f0048cbd26c@ADVAPI32.dll\"\n \"1100120024d3d26c@ADVAPI32.dll\"\n \"11001200c0d3d26c@ADVAPI32.dll\"\n \"1200130004d4d26c@ADVAPI32.dll\"\n \"120013005cd4d26c@ADVAPI32.dll\"\n \"14001500ecf3d26c@ADVAPI32.dll\"\n \"1400150004f4d26c@ADVAPI32.dll\"\n \"140015001cf4d26c@ADVAPI32.dll\"\n \"1700180034f4d26c@ADVAPI32.dll\"\n \"0d000e004cf4d26c@ADVAPI32.dll\"\n \"0d000e00acd4d26c@SHELL32.dll\"\n \"0d000e0028d5d26c@SHELL32.dll\"\n \"0f00100078f5d26c@ADVAPI32.dll\"\n \"14001500b8f5d26c@ADVAPI32.dll\"\n \"14001500d0f5d26c@ADVAPI32.dll\"\n \"0c000d0018f6d26c@ADVAPI32.dll\"\n \"0c000d0028f6d26c@ADVAPI32.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"WPFOSD.dll\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"SCM_Notice.exe\"","id":"static-164","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"\"; File: \"EyeXFramework.dll\")\n file/memory contains long string with (Indicator: \"\"; File: \"EyeXFramework.dll\")","id":"string-556","level":"informative","mitre_attack_id":"T1056.001","name":"Found strings related to keylogger","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"ECT * FROM Win32_DiskDrive\" (Indicator: \" win32_diskdrive\"; File: \"SCM_Notice.exe.3073113682\")","id":"string-55","level":"suspicious","mitre_attack_id":"T1047","name":"Found a reference to a WMI query string known to be used for VM detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg85E.tmp\" with delete access\n \"setup.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\VSD1510.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\MSI8474.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\MSI8AAF.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\36178ba7.ipi\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\36178ba9.msi\" with delete access\n \"msiexec.exe\" opened \"C:\\Config.Msi\\MSI9B89.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\MSI90BB.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Config.Msi\\MSID97E.tmp\" with delete access\n \"msiexec.exe\" opened \"C:\\Config.Msi\\36178ba8.rbs\" with delete access\n \"msiexec.exe\" opened \"C:\\Windows\\Installer\\36178ba4.msi\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"D:\\Project\\SCM\\SCM_32bit\\SBarIII\\CloseSCM\\obj\\x86\\Release\\CloseSCM.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"Process.Start\" in \"WPFOSD.dll\"\n Observed function \"Process.set_StartInfo\" in \"WPFOSD.dll\"\n Observed function \"Process.Start\" in \"SCM_Notice.exe\"\n Observed function \"Process.Start\" in \"SCM.exe\"","id":"static-111","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to start a process (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"CloseSCM.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 1512)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"WPFOSD.dll\"","id":"static-135","level":"informative","mitre_attack_id":"T1027.002","name":"Dotnet file contains function to dynamically call methods at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"$32","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$33","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-12839486\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-21526821\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-22537315","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\setup.exe /quiet /norestart\" - (UID: 00000000-00003344)\n \"setup.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\msiexec.exe\" -I \"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\SCMx86Setup.msi\" /quiet /norestart\" - (UID: 00000000-00002444)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"Execute: %WINDIR%\\TEMP\\DRPTools\\SCMx86\\setup.exe /quiet /norestart\" [Source: 00000000-00003344-00000455-26013059467]\n Observed system executable string:\"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\setup.exe /quiet /norestart\" [Source: 00000000-00003344-00000C40-26661424870]\n Observed system executable string:\"%WINDIR%\\system32\\msiexec.exe\" [Source: 00000000-00002444-00000C41-23826607060]\n Observed system executable string:\"\"%WINDIR%\\system32\\msiexec.exe\" -I \"%WINDIR%\\TEMP\\DRPTools\\SCMx86\\SCMx86Setup.msi\" /quiet /norestart\" [Source: 00000000-00002444-00000C41-23826607060]\n Observed system executable string:\"%WINDIR%\\system32\\DeviceCount.exe\" [Source: 00000000-00004044-00000BC1-54691525]\n Observed system executable string:\"%WINDIR%\\Installer\\{0975A490-B40D-453C-9725-8ADC88A798AB}\\_853F67D554F05449430E7E.exe\" [Source: 00000000-00004044-00000BC1-66871097]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"CloseSCM.exe\" sleeping for \"1566804069\" milliseconds","id":"api-24","level":"suspicious","mitre_attack_id":"T1497.003","name":"Tries to sleep for a long time (more than two minutes)","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$34","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$35","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"ocsp.digicert.com\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"nsm87F.tmp\" has type \"data\" - Location: [%TEMP%\\nsm87F.tmp]\n \"MSI90BB.tmp\" has type \"data\" - Location: [%WINDIR%\\Installer\\MSI90BB.tmp]\n \"MSI8AAF.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%WINDIR%\\Installer\\MSI8AAF.tmp]\n \"CFG8A02.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\CFG8A02.tmp]\n \"MSI8474.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%WINDIR%\\Installer\\MSI8474.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" (UID: 00000000-00003344)\n Spawned process \"setup.exe\" with commandline \"/quiet /norestart\" (UID: 00000000-00002444)\n Spawned process \"MSIService.exe\" with commandline \"-install\" (UID: 00000000-00002636)\n Spawned process \"MSIService.exe\" (UID: 00000000-00002560)\n Spawned process \"CloseSCM.exe\" with commandline \"install\" (UID: 00000000-00001512)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"\n \"msiexec.exe\" touched \"R:\"\n \"msiexec.exe\" touched \"S:\"\n \"msiexec.exe\" touched \"T:\"\n \"msiexec.exe\" touched \"U:\"\n \"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"","id":"api-31","level":"malicious","mitre_attack_id":"T1120","name":"Tries to access unusual system drive letters","origin":"API Call","relevance":9,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")","id":"string-217","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve user privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"DeviceCount.exe.2259178230\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"DeviceCount.exe.2259178230\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"DeviceCount.exe.2259178230\")","id":"string-533","level":"informative","mitre_attack_id":"T1480","name":"Contains ability to retrieve information set for devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"IsWow64Process\" with parameter \"3344\" - (UID: 00000000-00003344)\n \"setup.exe\" called \"IsWow64Process\" with parameter \"2444\" - (UID: 00000000-00002444)\n \"msiexec.exe\" called \"IsWow64Process\" with parameter \"3052\" - (UID: 00000000-00003052)\n \"msiexec.exe\" called \"IsWow64Process\" with parameter \"4044\" - (UID: 00000000-00004044)\n \"MsiExec.exe\" called \"IsWow64Process\" with parameter \"3600\" - (UID: 00000000-00003600)\n \"MSIService.exe\" called \"IsWow64Process\" with parameter \"2560\" - (UID: 00000000-00002560)\n \"CloseSCM.exe\" called \"IsWow64Process\" with parameter \"1512\" - (UID: 00000000-00001512)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"MSIService.exe.2424824512\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed large number of imported APIs from \"USER32.dll\" : \"221\" [Source: MSIWmiAcpi.dll]","id":"static-145","level":"informative","mitre_attack_id":"T1106","name":"PE file contains large number of import functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"setup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\VSD1510.tmp\\install.log\"","id":"api-159","level":"informative","mitre_attack_id":"T1074.001","name":"Writes log files","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"ControlService failed.\" (Indicator: \"ControlService\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains the ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"SCM.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"SCM.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"CloseSCM.exe\"","id":"static-138","level":"informative","mitre_attack_id":"T1012","name":"Dotnet code contains ability to query registry","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"setup.exe\" with commandline \"/quiet /norestart\" (UID: 00000000-00002444)\n Spawned process \"msiexec.exe\" with commandline \"-I \"%WINDIR%\\\\TEMP\\\\DRPTools\\\\SCMx86\\\\SCMx86Setup.msi\" /quiet / ...\" (UID: 00000000-00003052)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00004044)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding A4ADF456DC577729D946C95EA899A3B2\" (UID: 00000000-00003600)\n Spawned process \"MSIService.exe\" with commandline \"-install\" (UID: 00000000-00002636)\n Spawned process \"MSIService.exe\" (UID: 00000000-00002560)\n Spawned process \"CloseSCM.exe\" with commandline \"install\" (UID: 00000000-00001512)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$38","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$39","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"$3a","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveType\" (Indicator: \"GetDriveType\"; File: \"MSIODD.dll.1245732750\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WMIACPI\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WMIACPI\"; Key: \"MOFIMAGEPATH\"; Value: \"%windir%\\\\system32\\\\msiapcfg.dll\")\n \"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3b","id":"registry-71","level":"suspicious","name":"Queries the installation properties of user installed products","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-12839486\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-21526821\n \"msiexec.exe\" queries volume information of \"C:\\Program Files\\SCM\\SCM.exe\" at 00000000-00004044-0000010C-21874988\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00004044-0000010C-22537315\n \"msiexec.exe\" queries volume information of \"C:\\Program Files\\SCM\\SCM.exe\" at 00000000-00004044-0000010C-22537941\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00004044-0000010C-27133004\n \"CloseSCM.exe\" queries volume information of \"C:\\Program Files\\SCM\\CloseSCM.exe\" at 00000000-00001512-0000010C-10041776839823984","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$3d","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3e","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3f","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$40","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.938149340018095","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"MSIService.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\simple\" - (UID: 00000000-00002560)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 69870000\n \"setup.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 69870000","id":"module-2","level":"informative","mitre_attack_id":"T1129","name":"Loads rich edit control libraries","origin":"Loaded Module","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$41","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"setup.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\")\n \"msiexec.exe\" touched \"Msi install server\" (Path: \"HKCU\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{000C103E-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")\n \"msiexec.exe\" touched \"Shortcut\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00021401-0000-0000-C000-000000000046}\")","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\_MSIExecute\"\n \"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"CloseSCM.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: MSIWmiAcpi.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: MSIService.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: SETUP.EXE.65AE6164.bin)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 00006d0fbcbbbe01 & 00006d0fbcbbbe01 (UID: 00000000-00004044)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 0/B & 0/B (UID: 00000000-00004044)\n \"msiexec.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004044)","id":"api-223","level":"suspicious","mitre_attack_id":"T1070.006","name":"Calls an API typically used to query local/system time as file time","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"SCM.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"CloseSCM.exe\"","id":"static-139","level":"informative","mitre_attack_id":"T1112","name":"Dotnet code contains ability to modify/delete registry","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"\"msiexec.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1811c50\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"msiexec.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"17e85c8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"msiexec.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"17e3f20\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","id":"api-190","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to send the specified request to the HTTP server","origin":"API Call","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \".ndata\" is zero","id":"static-5","level":"informative","mitre_attack_id":"T1027","name":"PE file contains zero-size sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$43","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74FF0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74BB0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"setup.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"msiexec.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"MsiExec.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$44","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"MSIODD.dll.1245732750\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 984056)","id":"binary-26","level":"informative","mitre_attack_id":"T1497","name":"The input sample possibly contains the RDTSCP instruction","origin":"Binary File","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00004044.00000000.67970.001C0000.00000004.mdmp\n 00000000-00004044.00000001.69892.001C0000.00000004.mdmp\n 00000000-00004044.00000002.71810.001C0000.00000004.mdmp]","id":"string-169","level":"informative","mitre_attack_id":"T1071.003","name":"Found mail related domain names","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: MSIWmiAcpi.dll)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$45","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$46","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"MSIService.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\simple\"\n dwOpenMode: \"1073741827\"\n dwPipeMode: \"6\" - (UID: 00000000-00002560)","id":"api-275","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" reads file \"c:\\securiteinfo.com.program.unwanted.4468.24384.5290.exe\"\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsm87f.tmp\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample possibly contains the RDTSCP instruction","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"\"1.0.0.0\"\n \"4.0.0.0\"\n \"1.0.2.1\"\n \"12.0.0.0\"\n \"2.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"em.Windows.Forms,4.0.0.0,,b77a5c561934e089\"\n \"0.0.0.04\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0, Cul\"\n \"1.0.11.0\"\n \"192.168.242.88\"\n \"1.0.10.0\"\n Potential IP \"1.0.0.0\" found in string \"n=\"1.0.0.0\",Culture=\"neutral\",ProcessorArchitecture=\"x86\"=\"x86\"86\"yToken=\"70326046DCDCE6CB\"\nProcessorArchitecture=\"x86\"p again. The .NET Framework can be obtained from the web. Would you like to do this now?'.\", \"2.5.29.32\", \"2.5.29.14\", Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\", \"2.5.29.17\", \"2.5.29.1\", \"2.5.4.3\", \"2.5.29.19\", \"2.5.29.15\", Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\", \"2.5.29.31\", \"2.5.29.4\", \"2.5.29.10\", \"2.5.29.16\", \"2.5.4.6\", \"2.5.4.10\", \"2.5.4.11\", \"2.5.4.7\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"setup.exe\" called \"FindResourceW\" with parameter \"12537116\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"12537132\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"12537184\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"12539748\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"12539044\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"3205416\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"3205420\" - (UID: 00000000-00002444)\n \"setup.exe\" called \"FindResourceW\" with parameter \"1101\" - (UID: 00000000-00002444)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found string - \\\\.\\pipe\\simple; Source: \"17963-119-00401CA0\")\n Found string - \\.\\pipe\\simple; Source: \"00000000-00002560.00000000.70310.001C0000.00000004.mdmp, 00000000-00002560.00000001.72232.001C0000.00000004.mdmp\")\n Found string - \\\\.\\pipe\\simple; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"api-248","level":"informative","mitre_attack_id":"T1005","name":"Tries to open documents files","origin":"API Call","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00001512.00000000.70574.01D20000.00000004.mdmp, 00000000-00001512.00000000.70583.02D20000.00000004.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$48","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"WPFOSD.dll\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"SCM_Notice.exe\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"SCM.exe\"","id":"static-114","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute WMI queries (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003344)\n \"setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002444)\n \"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003052)\n \"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004044)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$49","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found string \"Optional default inproc handler. Only optionally provided if Context=CLSCTX_LOCAL_SERVER. Typically \"ole32.dll\" or \"mapi32.dll\"\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00004044.00000001.69892.017E0000.00000004.mdmp\")","id":"string-571","level":"informative","mitre_attack_id":"T1137","name":"Contains reference to messaging system library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4a","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"ShellExecuteEx failed with error code %d\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"msiexec.exe\" queries basic process information of the \"C:\\Config.Msi\\36178ba8.rbs\" (UID: 4044)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"msiexec.exe\" trying to open a file \"\\Device\\HarddiskVolume2\\Program Files\\SCM\\MSIECO\\GAMING.EPS\"\n \"msiexec.exe\" trying to open a file \"%PROGRAMFILES%\\SCM\\MSIECO\\GAMING.EPS\"","id":"api-99","level":"suspicious","mitre_attack_id":"T1005","name":"Tries to access gaming information (file access)","origin":"API Call","relevance":7,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsm87f.tmp\"\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" writes file \"c:\\windows\\temp\\drptools\\scmx86\\scmx86setup.msi\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"\"msiexec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003052)\n \"msiexec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004044)\n \"MsiExec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003600)","id":"api-219","level":"informative","mitre_attack_id":"T1021","name":"Calls an API typically used to register an interface (RPC)","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4b","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"string-265","level":"informative","mitre_attack_id":"T1547.001","name":"Contains reference to Windows Startup folder","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4d","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$4e","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"CloseSCM.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SCM\"; Value: \"%PROGRAMFILES%\\SCM\\SCM.exe\")","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4f","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed function \"get_ProcessName\" in \"CloseSCM.exe\"","id":"static-100","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to gather process details (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: EyeTracking.exe.2833855510","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"SCM_Notice.exe.3073113682\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$50","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"WPFOSD.dll\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"SCM.exe\"","id":"static-161","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability execute applications in hidden mode (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$51","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$52","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$53","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to load content into memory (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"GetActiveWindow\" (UID: 00000000-00003344)","id":"api-150","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get handle of currently active window","origin":"API Call","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" (Thread ID: 1144) slept \"525\" times (threshold: 500)","id":"api-47","level":"suspicious","mitre_attack_id":"T1497.003","name":"Possibly tries to evade analysis by sleeping many times","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","id":"api-40","level":"suspicious","mitre_attack_id":"T1056.001","name":"Calls an API typically used for keylogging","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Process \"msiexec.exe\" with commandline \"-I \"%WINDIR%\\\\TEMP\\\\DRPTools\\\\SCMx86\\\\SCMx86Setup.msi\" /quiet /norestart\" (UID: 00000000-00003052)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding A4ADF456DC577729D946C95EA899A3B2\" (UID: 00000000-00003600)\n","id":"target-152","level":"informative","mitre_attack_id":"T1218.007","name":"Detected msiexec.exe process execution","origin":"Monitored Target","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"WPFOSD.dll has big resource with name: \"images/gamming/eco/osd_location.png\" size: \"31228\" and abnormal entropy:\"7.98793122166\"\n WPFOSD.dll has big resource with name: \"scmsettingwindow.baml\" size: \"26272\" and abnormal entropy:\"6.20996225861\"\n WPFOSD.dll has big resource with name: \"scm.ico\" size: \"127204\" and abnormal entropy:\"7.64957408895\"\n WPFOSD.dll has big resource with name: \"images/gamming/scm/bg/scm_title.png\" size: \"13090\" and abnormal entropy:\"7.94727135897\"\n SCM_Notice.exe has big resource with name: \"scm.ico\" size: \"127204\" and abnormal entropy:\"7.64957408895\"\n SCM_Notice.exe has big resource with name: \"image/bg.png\" size: \"21453\" and abnormal entropy:\"7.96572885672\"","id":"static-129","level":"informative","mitre_attack_id":"T1027","name":"Dotnet file resource with suspicious entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"msiexec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SCM.LNK\"\n \"msiexec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\Users\\Public\\Desktop\\SCM.LNK\"\n \"msiexec.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SCM.lnk\"\n \"msiexec.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\SCM.lnk\"\n \"msiexec.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\SCM.LNK\"\n \"msiexec.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\SCM.LNK\"","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$54","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"DeviceCount.exe.2259178230\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"DeviceCount.exe.2259178230\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"DeviceCount.exe.2259178230\")","id":"string-253","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect presence of virtual environment (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed function \"get_OSVersion\" in \"WPFOSD.dll\"\n Observed function \"get_SystemDirectory\" in \"WPFOSD.dll\"\n Observed function \"get_UserName\" in \"SCM.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"SCM.exe\"\n Observed function \"get_OSVersion\" in \"EyeXFramework.dll\"","id":"static-120","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to gather system information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" connecting to \"\\ThemeApiPort\"\n \"setup.exe\" connecting to \"\\ThemeApiPort\"\n \"msiexec.exe\" connecting to \"\\ThemeApiPort\"\n \"MsiExec.exe\" connecting to \"\\ThemeApiPort\"\n \"MSIService.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","mitre_attack_id":"T1559","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$55","id":"api-113","level":"informative","mitre_attack_id":"T1083","name":"Touches files in program files directory","origin":"API Call","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"set_UseShellExecute\" in \"WPFOSD.dll\"\n Observed function \"set_UseShellExecute\" in \"SCM.exe\"","id":"static-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute application (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$56","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000\n \"setup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000\n \"MSIService.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000\n \"CloseSCM.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75E10000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"WPFOSD.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"SCM_Notice.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"SCM.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"DeviceCount.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"EyeXFramework.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"MSIECO.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"CloseSCM.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"EyeTracking.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"MSIODD.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Tobii.EyeX.Client.Net20.DLL\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"CloseSCM.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$57","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$58","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"$59","id":"network-78","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain custom Base62 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_70% (D)","id":"avtest-9","level":"suspicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","origin":"External System","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$5a","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$5b","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$5c","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$5d","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"CloseSCM.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67200000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","id":"registry-179","level":"informative","mitre_attack_id":"T1562.001","name":"Tries to map intranet network resources to internet zone","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"MSIService.exe.2424824512\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"MSIECO.dll\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"MSIECO.dll.810605288\")","id":"string-615","level":"informative","mitre_attack_id":"T1620","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".text\" is \"0x117a0c\" greater than 0x100000\n Virtual size of \".data\" is \"0x2be55c\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAWG7yjlbOiD9zQYNax1VpI%3D\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$5e","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"ECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; File: \"SCM_Notice.exe.3073113682\")","id":"string-507","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used for information discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSI78ba5.tmp (UID: 00000000-00004044)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSI78ba6.tmp (UID: 00000000-00004044)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\Config.Msi (UID: 00000000-00004044)","id":"api-121","level":"informative","mitre_attack_id":"T1070.004","name":"Calls an API typically used to remove a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to \"MSCF2Wqh disallowedcert.stl|f~3\"{-UAV>F :n;lpd`()\nhvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x\"3`CM:k^nLuSvMxfx4qM?{i%CVl\\tP-`}v?@s)?hRQ>jB@H4-\" (Indicator: \"Oid\"; File: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002444.00000001.69659.00500000.00000004.mdmp, 00000000-00002444.00000002.70721.00500000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"2344,3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001512.00000000.70583.00480000.00000004.mdmp\")\n Found reference to API \"28315993614,3680,3025,,RtlGetNtProductType,NTDLL.dll,\"252:05:15.584\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004044.00000000.67970.001C0000.00000004.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about operating system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"Set GUID_HIGH_PERFORMANCE success!!\" (Indicator: \"set \"; File: \"MSIECO.dll.810605288\")","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed function \"ResourceManager.GetObject\" in \"SCM.exe\"\n Observed function \"ResourceManager.GetObject\" in \"DeviceCount.exe\"","id":"static-112","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load content from resource","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"The entire certificate chain of the input sample was validated successfully.","id":"certificate-2","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a valid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SCM.exe.config\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%PROGRAMFILES%\\SCM\\SCM.exe.config]\n \"CFG8A02.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\CFG8A02.tmp]","id":"binary-39","level":"informative","mitre_attack_id":"T1105","name":"Drops XML files","origin":"Binary File","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$5f","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"\"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1811c50\"\n \"lpReserved\": \"0\"}\n \"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"17e85c8\"\n \"lpReserved\": \"0\"}\n \"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"17e3f20\"\n \"lpReserved\": \"0\"}","id":"api-191","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to to receive the response to a HTTP requests","origin":"API Call","relevance":2,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$60","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$61","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$62","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"DeviceCount.exe.2259178230\")","id":"string-442","level":"informative","mitre_attack_id":"T1485","name":"Contains ability to delete device information set (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"$63","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" opened \"\\Device\\KsecDD\"\n \"setup.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"CloseSCM.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003344)\n \"setup.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002444)\n \"msiexec.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00004044)","id":"api-144","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to open an existing named mutex object","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"ECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; File: \"SCM_Notice.exe.3073113682\")","id":"string-514","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used to retrieve disk information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyExA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"MSIWmiAcpi.dll\" claimed CRC 1609077 while the actual is CRC 3945570\n \"Tobii.EyeX.Client.dll\" claimed CRC 884273 while the actual is CRC 1609077\n \"MSIService.exe\" claimed CRC 225096 while the actual is CRC 297079\n \"EyeXFramework.dll\" claimed CRC 107308 while the actual is CRC 225096\n \"SETUP.EXE.65AE6164.bin\" claimed CRC 441514 while the actual is CRC 61099\n \"Tobii.EyeX.Client.Net20.DLL\" claimed CRC 158133 while the actual is CRC 441514","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MSIService.exe.2424824512\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003344)\n \"setup.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002444)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$64","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","id":"registry-139","level":"informative","mitre_attack_id":"T1082","name":"Queries volatile registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".text\" is \"0x117c00\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"No hash or public key info found.\" (Indicator: \"public key\"; File: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found string \"AssemblyCheck: error setting public key token: %d\" (Indicator: \"public key\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found string \"No hash or public key info found.\" (Indicator: \"public key\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004044.00000000.67970.001C0000.00000004.mdmp, 00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp\")","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$65","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$66","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Contains the ability to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsm87F.tmp\"\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" writes to a file \"C:\\Windows\\Temp\\DRPTools\\SCMx86\\SCMx86Setup.msi\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$67","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$68","id":"string-226","level":"informative","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003344)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003052)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004044)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MSIService.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"CloseSCM.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$69","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetTextCharsetInfo\" (Indicator: \"GetTextCharset\"; Source: \"00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"MSIService.exe.2424824512\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\" has an writable section named \".data\"\n \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\" has an writable section named \".ndata\"\n \"MSIWmiAcpi.dll\" has an writable section named \".data\"\n \"Tobii.EyeX.Client.dll\" has an writable section named \".data\"\n \"devcon.dll\" has an writable section named \".data\"\n \"devcon.dll\" has an writable section named \".tls\"\n \"MSIService.exe\" has an writable section named \".data\"\n \"SETUP.EXE.65AE6164.bin\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"setup.exe\" with commandline \"/quiet /norestart\" (UID: 00000000-00002444)\n Spawned process \"msiexec.exe\" with commandline \"-I \"%WINDIR%\\\\TEMP\\\\DRPTools\\\\SCMx86\\\\SCMx86Setup.msi\" /quiet / ...\" (UID: 00000000-00003052)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00004044)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding A4ADF456DC577729D946C95EA899A3B2\" (UID: 00000000-00003600)\n Spawned process \"MSIService.exe\" with commandline \"-install\" (UID: 00000000-00002636)\n Spawned process \"MSIService.exe\" (UID: 00000000-00002560)\n Spawned process \"CloseSCM.exe\" with commandline \"install\" (UID: 00000000-00001512)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$6a","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Source: MSIService.exe]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"192.229.211.108:80\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$6b","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"\"setup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"setup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\simple\n Found string - \\.\\pipe\\simple","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$6c","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$6d","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003052.00000000.67908.00601000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"password to run service with. (with StartName)\" (Indicator: \"password\"; Source: \"00000000-00003052.00000000.67908.003CC000.00000004.mdmp, 00000000-00003052.00000001.69826.00370000.00000004.mdmp, 00000000-00003052.00000002.70707.00370000.00000004.mdmp\")\n Found string \"password to run service with. (with StartName)\" (Indicator: \"password\"; Source: \"00000000-00004044.00000001.69892.001C0000.00000004.mdmp, 00000000-00004044.00000002.71810.001C0000.00000004.mdmp\")","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$6e","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$6f","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$70","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$71","id":"static-101","level":"informative","mitre_attack_id":"T1106","name":"Found Native API in Dotnet file","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"ocsp.digicert.com\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002636.00000000.70209.0041F000.00000002.mdmp, 00000000-00002636.00000000.70245.10119000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003344.00000000.67508.00408000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg85E.tmp\" for deletion\n \"setup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\VSD1510.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\MSI8474.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\MSI8AAF.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\36178ba7.ipi\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\36178ba9.msi\" for deletion\n \"msiexec.exe\" marked \"C:\\Config.Msi\\MSI9B89.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\MSI90BB.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Config.Msi\\MSID97E.tmp\" for deletion\n \"msiexec.exe\" marked \"C:\\Config.Msi\\36178ba8.rbs\" for deletion\n \"msiexec.exe\" marked \"C:\\Windows\\Installer\\36178ba4.msi\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"$72","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290\" has an executable section named \".text\"\n \"MSIWmiAcpi.dll\" has an executable section named \".text\"\n \"Tobii.EyeX.Client.dll\" has an executable section named \".text\"\n \"WPFOSD.dll\" has an executable section named \".text\"\n \"SCM_Notice.exe\" has an executable section named \".text\"\n \"devcon.dll\" has an executable section named \".text\"\n \"SCM.exe\" has an executable section named \".text\"\n \"DeviceCount.exe\" has an executable section named \".text\"\n \"MSIService.exe\" has an executable section named \".text\"\n \"EyeXFramework.dll\" has an executable section named \".text\"\n \"MSIECO.dll\" has an executable section named \".text\"\n \"CloseSCM.exe\" has an executable section named \".text\"\n \"EyeTracking.exe\" has an executable section named \".text\"\n \"MSIODD.dll\" has an executable section named \".text\"\n \"SETUP.EXE.65AE6164.bin\" has an executable section named \".text\"\n \"Tobii.EyeX.Client.Net20.DLL\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$73","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"setup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"URLDownloadToCacheFile failed with HRESULT '%d'\" (Indicator: \"URLDownload\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"URLDownloadToCacheFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002444.00000000.67739.00BF1000.00000020.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$74","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"System Security","description":"$75","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$76","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$77","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"65ae60c9fe68a40981022c25","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":1,"suspicious_count":0,"total_engines":24},"mitre_attacks":{"total":82},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":239,"malicious_count":3,"suspicious_count":21,"total":263}},"summary":{"score":100,"tags":["evasive"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"SecuriteInfo.com.Program.Unwanted.4468.24384.5290","file_size":3884096,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf","md5":"3137bbf88d80a164b35def3024ef152a","sha1":"c0bab2f371cdcd7bd53fd1cff6cadcd3505c4fa1","sha256":"83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0","sha512":"a59452c610fe845b00feff5a98972ebdc39f8ffbbb3261bed6d54eab5c3066bec5e2fd1c118d4880faf8402ede29d23934d7e98ba6feb9a64efab66c8baf7899","ssdeep":"98304:uHLi/kJwZwPb9L/0rQq98ZU+LsXCKqRkMccz2938N:XYwgVqWjwCKibB","ssdeep_chunks":["98304:uHLi/kJ","98304:HLi/kJw","98304:Li/kJwZ","98304:i/kJwZw","98304:/kJwZwP","98304:kJwZwPb","98304:JwZwPb9","98304:wZwPb9L","98304:ZwPb9L/","98304:wPb9L/0","98304:Pb9L/0r","98304:b9L/0rQ","98304:9L/0rQq","98304:L/0rQq9","98304:/0rQq98","98304:0rQq98Z","98304:rQq98ZU","98304:Qq98ZU+","98304:q98ZU+L","98304:98ZU+Ls","98304:8ZU+LsX","98304:ZU+LsXC","98304:U+LsXCK","98304:+LsXCKq","98304:LsXCKqR","98304:sXCKqRk","98304:XCKqRkM","98304:CKqRkMc","98304:KqRkMcc","98304:qRkMccz","98304:RkMccz2","98304:kMccz29","98304:Mccz293","98304:ccz2938","98304:cz2938N","196608:uHLi/kJ","196608:HLi/kJw","196608:Li/kJwZ","196608:i/kJwZw","196608:/kJwZwP","196608:kJwZwPb","196608:JwZwPb9","196608:wZwPb9L","196608:ZwPb9L/","196608:wPb9L/0","196608:Pb9L/0r","196608:b9L/0rQ","196608:9L/0rQq","196608:L/0rQq9","196608:/0rQq98","196608:0rQq98Z","196608:rQq98ZU","196608:Qq98ZU+","196608:q98ZU+L","196608:98ZU+Ls","196608:8ZU+LsX","196608:ZU+LsXC","196608:U+LsXCK","196608:+LsXCKq","196608:LsXCKqR","196608:sXCKqRk","196608:XCKqRkM","196608:CKqRkMc","196608:KqRkMcc","196608:qRkMccz","196608:RkMccz2","196608:kMccz29","196608:Mccz293","196608:ccz2938","196608:cz2938N","98304:XYwgVqW","98304:YwgVqWj","98304:wgVqWjw","98304:gVqWjwC","98304:VqWjwCK","98304:qWjwCKi","98304:WjwCKib","98304:jwCKibB"]},"submissions":{"first_seen":1705926858000,"last_multi_scan":1705926858000,"last_seen":1705926858000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["65ae60c9fe68a40981022c25"]},"schema_version":"1.0.9","sha256":"83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0","threat_score":100,"unified_at":"2026-09-16T18:25:21.016Z","unified_at_epoch_ms":1789583121016,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win/grayware_confidence_70% Sample 83d48ca1aa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 83d48ca1aa22…. Malware family: Win/grayware_confidence_70%. Threat score 100/100. 1/24 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_70% Sample 83d48ca1aa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 83d48ca1aa22…. Malware family: Win/grayware_confidence_70%. Threat score 100/100. 1/24 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_70% Sample 83d48ca1aa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 83d48ca1aa22…. Malware family: Win/grayware_confidence_70%. Threat score 100/100. 1/24 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L78","11",{}]]