24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T414,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 9b59aa79432e… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 9b59aa79432e…. Threat score 85/100. 0/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41"],"about":{"@type":"SoftwareApplication","name":"setup.msi","applicationCategory":["msi","data"],"identifier":"9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1c15,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "setup.msi") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "setup.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup.msi") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "setup.msi") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "setup.msi") Found reference to API "_WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "WaitForSingleObject(mutex)" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "WaitForSingleObject() returned WAIT_ABANDONED" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "WaitForSingleObject(semaphore)" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "unexpected WaitForSingleObject() return" (Indicator: "WaitForSingleObject"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")26:T991,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "setup.msi") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibrary(%s): failed to load." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "LoadLibrary(%s): loaded ok." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "LoadLibrary(%s): already loaded." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "wxPluginManager::LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?LoadLibrary@wxPluginManager@@SAPAVwxPluginLibrary@@ABVwxString@@H@Z" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")27:T73f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "setup.msi") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "setup.msi") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02639000.00000004.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02639000.00000004.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp")28:Td7d,Found string - \\.\pipe\ToServer; Source: "setup.msi") Found string - ((\d+[jJ]|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)[jJ])|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)|(0[xX][\da-fA-F]+[lL]?|0[bB][01]+[lL]?|(0[oO][0-7]+)|(0[0-7]*)[lL]?|[1-9]\d*[lL]?)); Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string - [ \f\t]*(\\\r?\n[ \f\t]*)*(#[^\r\n]*)?(((\d+[jJ]|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)[jJ])|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)|(0[xX][\da-fA-F]+[lL]?|0[bB][01]+[lL]?|(0[oO][0-7]+)|(0[0-7]*)[lL]?|[1-9]\d*[lL]?))|((\*\*=?|>>=?|<<=?|<>|!=|//=?|[+\-*/%&|^=<>]=?|~)|[][(){}]|(\r?\n|[:;.,`@]))|([uU]?[rR]?'[^\n'\\]*(?:\\.[^\n'\\]*)*'|[uU]?[rR]?"[^\n"\\]*(?:\\.[^\n"\\]*)*")|[a-zA-Z_]\w*); Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp"), Found string - (((\d+[jJ]|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)[jJ])|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)|(0[xX][\da-fA-F]+[lL]?|0[bB][01]+[lL]?|(0[oO][0-7]+)|(0[0-7]*)[lL]?|[1-9]\d*[lL]?))|((\*\*=?|>>=?|<<=?|<>|!=|//=?|[+\-*/%&|^=<>]=?|~)|[][(){}]|(\r?\n|[:;.,`@]))|([uU]?[rR]?'[^\n'\\]*(?:\\.[^\n'\\]*)*'|[uU]?[rR]?"[^\n"\\]*(?:\\.[^\n"\\]*)*")|[a-zA-Z_]\w*); Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp"), Found string - |\d+[eE][-+]?\d+)[jJ])|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)|(0[xX][\da-fA-F]+[lL]?|0[bB][01]+[lL]?|(0[oO][0-7]+)|(0[0-7]*)[lL]?|[1-9]\d*[lL]?))|((\*\*=?|>>=?|<<=?|<>|!=|//=?|[+\-*/%&|^=<>]=?|~)|[][(){}]|; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp"), Found string - (\d+[jJ]|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)[jJ]); Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp"), Found string - (\d+\.\d*|\.\d+)([eE][-+]?\d+)?; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp"), Found string - ((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+); Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp"), Found string - [ \f\t]*((\\\r?\n|#[^\r\n]*|([uU]?[rR]?'''|[uU]?[rR]?"""))|((\d+[jJ]|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)[jJ])|((\d+\.\d*|\.\d+)([eE][-+]?\d+)?|\d+[eE][-+]?\d+)|(0[xX][\da-fA-F]+[lL]?|0[bB][01]+[lL]?|(0[oO][0-7]+)|(0[0-7]*)[lL]?|[1-9]\d*[lL]?))|((\*\*=?|>>=?|<<=?|<>|!=|//=?|[+\-*/%&|^=<>]=?|~)|[][(){}]|(\r?\n|[:;.,`@]))|([uU]?[rR]?'[^\n'\\]*(?:\\.[^\n'\\]*)*('|\\\r?\n)|[uU]?[rR]?"[^\n"\\]*(?:\\.[^\n"\\]*)*("|\\\r?\n))|[a-zA-Z_]\w*); Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp")29:T97b,Contains base64 string in header "POST" in header "POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: cbsnaturalway.comContent-Length: 79Cache-Control: no-cache" Contains base64 string in header "/diagnostics" in header "POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: cbsnaturalway.comContent-Length: 79Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: cbsnaturalway.comContent-Length: 79Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: cbsnaturalway.comContent-Length: 79Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: cbsnaturalway.comContent-Length: 79Cache-Control: no-cache" Contains base64 string in header "/version" in header "GET /version.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "Encoding" in header "GET /version.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "identityHost" in header "GET /version.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "urllib/2" in header "GET /version.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "Encoding" in header "GET /messages.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "identityHost" in header "GET /messages.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7" Contains base64 string in header "urllib/2" in header "GET /messages.txt HTTP/1.1Accept-Encoding: identityHost: taskcoach.orgConnection: closeUser-Agent: Python-urllib/2.7"2a:T483,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "setup.msi") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "setup.msi") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "setup.msi") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "setup.msi") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "setup.msi") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "setup.msi") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")2b:T44e,Found reference to API "getaddrinfo" (Indicator: "getaddrinfo"; Source: "00000000-00010656-00000C2A-1491962961") Found reference to API "getaddrinfo(host, port [, family, socktype, proto, flags])" (Indicator: "getaddrinfo"; Source: "00000000-00010656.00000000.159048.021D8000.00000004.mdmp") Found reference to API "getaddrinfo returns an empty list" (Indicator: "getaddrinfo"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found reference to API "getaddrinfo" (Indicator: "getaddrinfo"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp")2c:T850,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "setup.msi") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "setup.msi") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "setup.msi") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "setup.msi") Found reference to API "sendMessage" (Indicator: "sendmessage"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found reference to API "an internal call to the PostMessage function has failed." (Indicator: "postmessage"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "PostMessage(WM_QUIT)" (Indicator: "postmessage"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")2d:T51e,"taskcoach.exe" called "GetWindowTextW" with parameter "HyperTreeList" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Toolbars are customizable" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Click on the gear icon on the right to add buttons and rearrange them." - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Click on the gear icon on the right to add buttons andrearrange them." - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Task Coach is actively developed. Although the Task Coach developers try hard to prevent them, bugs do happen. So, backing up your" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Task Coach is actively developed. Although the Task Coach developers try hard to prevent them, bugsdo happen. So, backing up your" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Next tip" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "Show tips on startup" - (UID: 00000000-00010656) "taskcoach.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00010656)2e:Ted4,"taskcoach.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000a000e00489f650040a26500b1cafd7640a26500000000002800000000000000000064002cf41900 (UID: 00000000-00010656) "taskcoach.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00010656) "taskcoach.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000b42f2000f8f01900650902771200000000000000d06c7c760200000040216500b42f200018f11900650902771200000000000000d06c7c76f0b98275120000002cf11900ae2eff760200000000000000d06c7c763cf11900e16c7c76020000000000000064f1190068202076020000000000000042fe0b5070928a7500000000a4f11900201b2576ffffffffb4f11900581020763c10207692fe0b5070928a759cb98275f0b9827594f1190090f119000d0000000d0000005041a6757cc8df75000000004041a675b0f1190028f21900608d23766e1a3e26feffffffc0f11900900f20765041a675d0f11900062599757cc8df755041a675dcf11900 (UID: 00000000-00010656) "taskcoach.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00010656) "taskcoach.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000002000066023930000904010000000000000000000100000000030000000d00000d9800000040000000000000001300000040000000562d00008c2d00001103001220de690000000000ab02000074d2fffffebafd76000000008a2164000000000040bb1900c0b8190000006400f302000000000000c0b81900ff070000c0006400502d640000fdffff39300000000064006815000000000000d83e6900800008027f070000000000000100000080000802000800000100640001000000400100010a00140018de690018de6900000000000000000073006500ff07000020de690000000000550042008000010001006602fc1d000044010001ff070000 (UID: 00000000-00010656) "taskcoach.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000002100fd17e4b71900e2d20372000000002100fd17f8b71900b1d203722100fd1748cd03722100fd173cba190069d2037248cd0372bcd4690034d203724bd20372200000008800000030b8190000000000000000007b000000000000000000037243003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004b006f0071006c0070006f002000430079006e0061007600200054006f006f006c005c00570049004e0049004e00450054002e0064006c006c000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00010656)2f:Ta4d,"taskcoach.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000002769022034105300276902000000000000000050cf680250cf6802481a1f1e9949011eb06d68020027690250cf6802481a1f1eb0ee190000000000e82669020200000020341053b06d6802b0ee1900002769025048011e4099001e50cf680200276902fc94011eb06d68020027690220341053002769020000000000000000 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000cf63217220af297a903521722818217202000000a07f21722c5266021052660290d119000018237264d21900406421724c811208feffffffd0d1190000642172a07f2172e8d119009f352172a07f2172cf7b987601000000d015237214d21900a15d2172001821722c1821720000000019de88760000000001000000 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000018217202000000110000002c52660280000000000000000000660264d21900406421724c811208d8d11900febafd76000000000000000080000000a0422b72f8d119002d839676000066020000000080000000a0422b720200000044182b7210d21900ab422b7280000000d4472b7201000000f0152c723cd2190061442b72 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000008c1d1e6ca21900000000005064011e00000000b0a21900a264011e8ca219000000000000dc1b1eb88c1d1e4f65011e00000000d085d502cc181f1e6765011e5064011e51171b8a30798204d8a2190030aed802cc181f1ed085d502cc181f1e94ca8d02fc94011e3079820430aed80251171b8a30aed8020000000000000000 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000008c1d1ed4a21900000000005064011e0000000018a31900a264011ef4a219000000000000dc1b1eb88c1d1e4f65011e00000000d085d502cc181f1e6765011e5064011e51171b8a3079820440a3190030aed802cc181f1ed085d502cc181f1e94ca8d02fc94011e3079820430aed80251171b8a30aed8020000000000000000 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000640000002000520008b76800000000005200000000000000789c690057a4690058a46900f8b6680000006400000000001cba1900a6ebfd76000000000000000000000000f02c0e720100000023ba190030ba1900d8daff76000064000000000058a4690050ba1900dfce0372ecce03720100000058a4690000000000 (UID: 00000000-00010656) "taskcoach.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000063d502000000005300000054660105d047f80400000000080000003c0100009ba8ea1c000000009463d502cc7b1f1e20000000b0a3790200000000602d290240ee190020341053b06d680200ee1900002769021816ea02608bd40254660105f8981f1efc94011eb06d68020027690220341053002769020000000000000000 (UID: 00000000-00010656)30:Tc56,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "setup.msi") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "setup.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?wxGetLocalTime@@YAJXZ" (Indicator: "GetLocalTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp") Found reference to API "?wxGetLocalTimeMillis@@YA?AVwxLongLongNative@@XZ" (Indicator: "GetLocalTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp")31:T4c8,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "setup.msi") Found reference to API "GetDiskFreeSpace" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp")32:Tee5,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup.msi") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")33:T49a,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "setup.msi") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "setup.msi") Found reference to API "ExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")34:Tc56,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "setup.msi") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "setup.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?wxGetLocalTime@@YAJXZ" (Indicator: "GetLocalTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp") Found reference to API "?wxGetLocalTimeMillis@@YA?AVwxLongLongNative@@XZ" (Indicator: "GetLocalTime"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp")35:T7e2,Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp") Found reference to API "GetVersionEx() failed" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?GetVersion@wxDynamicLibraryDetails@@QBE?AVwxString@@XZ" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "?GetVersionMadeBy@wxZipEntry@@IBEHXZ" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "?GetVersionNeeded@wxZipEntry@@IBEHXZ" (Indicator: "GetVersion"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")36:T16de,"taskcoach.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\PYTHON27.DLL (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\zlib.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_hashlib.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_socket.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_ssl.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._core_.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._gdi_.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._windows_.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._controls_.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._misc_.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32api.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\zope.interface._zope_interface_coptimizations.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\twisted.python._initgroups.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_ctypes.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\pywintypes27.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32process.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\select.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32file.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter sfc.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32event.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32gui.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\pythoncom27.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\win32com.shell.shell.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter msvcr90.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter rpcrt4 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter Uxtheme.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_winxptheme.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._html.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\bz2.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._gizmos.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._combo.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._grid.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\wx._wizard.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\igraph._igraph.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\cairo._cairo.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter %APPDATA%\Koqlpo Cynav Tool\_pysyncml.pyd (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00010656) "taskcoach.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00010656)37:T98b8,"taskcoach.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyRun_SimpleString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_GetPath (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_SetPythonHome (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_SetProgramName (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyString_AsStringAndSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyString_AsString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyArg_ParseTuple (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyErr_Format (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyInt_FromLong (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyInt_AsLong (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyLong_FromVoidPtr (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_InitModule4 (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyTuple_New (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyTuple_SetItem (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyCFunction_NewEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_BuildValue (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_Call (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySys_WriteStderr (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_IsInstance (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyInt_Type (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter _Py_NoneStruct (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyExc_ImportError (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter _Py_PackageContext (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyGILState_Ensure (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyGILState_Release (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyString_FromString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_FdIsInteractive (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyRun_InteractiveLoop (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySys_SetArgv (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySequence_Length (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PySequence_GetItem (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyBool_FromLong (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_VerboseFlag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_NoSiteFlag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_OptimizeFlag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Py_IgnoreEnvironmentFlag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyList_New (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyList_SetItem (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_hashlib (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_socket (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_ssl (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_core_ (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_gdi_ (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_windows_ (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_controls_ (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_misc_ (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessDeniedAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessAllowedAceEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessAllowedObjectAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessDeniedAceEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAccessDeniedObjectAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAuditAccessAceEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddAuditAccessObjectAce (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorControl (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initwin32api (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetComputerObjectNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLongPathNameA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetSystemFileCacheSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetDllDirectoryW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetSystemPowerState (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ChangeDisplaySettingsExA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsExA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegRestoreKeyW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegSaveKeyExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegCreateKeyTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegOpenKeyTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegDeleteKeyTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegCopyTreeW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RegOverridePredefKey (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_zope_interface_coptimizations (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_initgroups (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_ctypes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initpywintypes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initwin32process (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessIoCounters (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessShutdownParameters (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetProcessShutdownParameters (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessPriorityBoost (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThreadPriorityBoost (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetThreadPriorityBoost (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThreadIOPendingFlag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThreadTimes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetThreadIdealProcessor (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetProcessAffinityMask (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetGuiResources (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initselect (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initwin32file (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EncryptFileW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DecryptFileW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EncryptionDisable (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FileEncryptionStatusW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter QueryUsersOnEncryptedFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FreeEncryptionCertificateHashList (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter QueryRecoveryAgentsOnEncryptedFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RemoveUsersFromEncryptedFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AddUsersToEncryptedFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DuplicateEncryptionInfoFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter OpenEncryptedFileRawW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReadEncryptedFileRaw (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter WriteEncryptedFileRaw (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CloseEncryptedFileRaw (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetVolumeMountPointW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DeleteVolumeMountPointW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetVolumePathNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetVolumePathNamesForVolumeNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateHardLinkTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter BackupRead (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter BackupSeek (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter BackupWrite (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetFileShortNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CopyFileTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MoveFileWithProgressW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MoveFileTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReplaceFileW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateFileTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DeleteFileTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFileAttributesTransactedA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFileAttributesTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetFileAttributesTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateDirectoryTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter RemoveDirectoryTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindFirstStreamTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindFirstFileTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindFirstFileNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindFirstFileNameTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter FindNextFileNameW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLongPathNameTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFullPathNameTransactedW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetFullPathNameTransactedA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReOpenFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter OpenFileById (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SfcGetNextProtectedFile (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initwin32event (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initwin32gui (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLayeredWindowAttributes (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetMenuInfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetMenuInfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AngleArc (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter PlgBlt (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetWorldTransform (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetWorldTransform (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ModifyWorldTransform (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CombineTransform (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter MaskBlt (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter TransparentBlt (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initpythoncom (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initshell (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetFolderLocation (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHEmptyRecycleBinA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHQueryRecycleBinW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetSettings (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHILCreateFromPath (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHShellFolderView_Message (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellFolderView (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateDefaultExtractIcon (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetNameFromIDList (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AssocCreateForClasses (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellItemArray (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellItemArrayFromDataObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellItemArrayFromIDLists (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellItemArrayFromShellItem (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateDefaultContextMenu (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateDataObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateItemFromIDList (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateItemFromRelativeName (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateItemInKnownFolder (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateItemWithParent (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetIDListFromObject (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateShellItem (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHOpenFolderAndSelectItems (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetCurrentProcessExplicitAppUserModelID (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHGetViewStatePropertyBag (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter AssocCreate (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SHCreateStreamOnFileEx (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter uuid_generate_random (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter uuid_generate_time (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter UuidCreate (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter UuidCreateSequential (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_winxptheme (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_html (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter initbz2 (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_gizmos (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_combo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_grid (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_wizard (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_igraph (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_cairo (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter init_pysyncml (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00010656) "taskcoach.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00010656)38:Tfab,"SELECT `Data` FROM `Binary` WHERE `Name` = '" (Source: setup.msi, Indicator: "select `data` from `binary` where `name` = '") "SELECT `Data` FROM `Binary` WHERE `Name` = 'viewer.exe'" (Source: setup.msi, Indicator: "select `data` from `binary` where `name` = 'viewer.exe'") "SELECT `Name`,`Event`,`ResetPeriod`,`RebootMessage`,`Command`,`Actions`,`DelayActions`,`Component_` FROM `AI_ServiceConfigFailureActions`" (Source: setup.msi, Indicator: "select `name`,`event`,`resetperiod`,`rebootmessage`,`command`,`actions`,`delayactions`,`component_` from `ai_serviceconfigfailureactions`") "SELECT `Text` FROM `Control` WHERE `Control`.`Dialog_`='%s' AND `Control`.`Control`='%s'" (Source: setup.msi, Indicator: "select `text` from `control` where `control`.`dialog_`='%s' and `control`.`control`='%s'") "SELECT `Registry`, `Root`,`Key`,`Name`,`Value`,`Component_` FROM `Registry` WHERE `Registry`.`Registry`=" (Source: setup.msi, Indicator: "select `registry`, `root`,`key`,`name`,`value`,`component_` from `registry` where `registry`.`registry`=") "INSERT INTO `" (Source: setup.msi, Indicator: "insert into `") "SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'" (Source: setup.msi, Indicator: "select * from `%s` where `property`='%s' and `value`='%s'") "SELECT * FROM `%s` WHERE `Property`='%s'" (Source: setup.msi, Indicator: "select * from `%s` where `property`='%s'") "SELECT `Message` FROM `Error` WHERE `Error` = %s" (Source: setup.msi, Indicator: "select `message` from `error` where `error` = %s") "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: setup.msi, Indicator: "select `text` from `uitext` where `key` = '%s'") "SELECT * FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'" (Source: setup.msi, Indicator: "select * from `control` where `dialog_` = '%s' and `control` = '%s'") "SELECT `Attributes` FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'" (Source: setup.msi, Indicator: "select `attributes` from `control` where `dialog_` = '%s' and `control` = '%s'") "SELECT `Attributes` FROM `Component` WHERE `Component` = '%s'" (Source: setup.msi, Indicator: "select `attributes` from `component` where `component` = '%s'") "SELECT `ActionProperty` FROM `Upgrade`" (Source: setup.msi, Indicator: "select `actionproperty` from `upgrade`") "DELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'" (Source: setup.msi, Indicator: "delete from `shortcut` where `shortcut`.`directory_`='%s'") "DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'" (Source: setup.msi, Indicator: "delete from `inifile` where `inifile`.`section`='internetshortcut' and`inifile`.`dirproperty`='%s'") "SELECT * FROM `%s`" (Source: setup.msi, Indicator: "select * from `%s`") "SELECT `Component` FROM `Component`" (Source: setup.msi, Indicator: "select `component` from `component`") "SELECT `Name` FROM `Binary` WHERE `Name` = '%s'" (Source: setup.msi, Indicator: "select `name` from `binary` where `name` = '%s'") "SELECT * FROM `Control` WHERE `Type` = 'Bitmap'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'bitmap'") "SELECT * FROM `Control` WHERE `Type` = 'Icon'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'icon'") "SELECT * FROM `Control` WHERE `Type` = 'PushButton'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'pushbutton'") "SELECT `Argument`, `Condition` FROM `ControlEvent` WHERE `Dialog_` = 'ExitDialog' AND `Control_` = 'Finish' AND `Event` = 'DoAction' ORDER BY `Ordering`" (Source: setup.msi, Indicator: "select `argument`, `condition` from `controlevent` where `dialog_` = 'exitdialog' and `control_` = 'finish' and `event` = 'doaction' order by `ordering`") "SELECT `Feature` FROM `Feature`" (Source: setup.msi, Indicator: "select `feature` from `feature`") "SELECT `UserName` FROM `AI_UserAccounts` WHERE `UserName` = ?" (Source: setup.msi, Indicator: "select `username` from `ai_useraccounts` where `username` = ?")39:T453,Found reference to API "CreateThread in wxExecute" (Indicator: "CreateThread"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "ResumeThread in wxExecute" (Indicator: "ResumeThread"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")3a:T41e,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "setup.msi") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "setup.msi") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "setup.msi") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")3b:T71c,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "setup.msi") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "setup.msi") Found reference to API "GetLastError API returned:" (Indicator: "GetLastError"; File: "setup.msi") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "DdeGetLastError" (Indicator: "GetLastError"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "?GetLastError@wxStreamBase@@QBE?AW4wxStreamError@@XZ" (Indicator: "GetLastError"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp")3c:T807,"binary information in the Data column.OutOfRbDiskDlgAboutBtnImageButton[AboutBtnIcon]MaintenanceWelcomeDlgCancel[ButtonImage]NextReinstallButtonLaunchButtonAboutDlgNoAdminWelcomeDlgBrowseDlgOKCancelDlgYesErrorDlgExitDialogFinishLaunchBtnViewReadmeCheckBoxImageCheckBox[CheckboxImage]FatalErrorFilesInUseExitRetryIgnoreMsiRMFilesInUseOutOfDiskDlgPatchWelcomeDlgPrepareDlgProgressDlgProgressBarStyledProgressBarLaunchCheckBoxResumeDlgInstallUserExitWelcomeDlgBack[CustomInstallBtn]PathSoftware\[Manufacturer]\[Prod@H" in Source: setup.msi "Software\Classes" in Source: setup.msi "Software\Microsoft\Windows NT\CurrentVersion" in Source: setup.msi "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: setup.msi "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: setup.msi "Software\Caphyon\Advanced Installer" in Source: setup.msi "Software\Caphyon\Advanced Installer\Installation Path" in Source: setup.msi "SOFTWARE\Microsoft\InetStp" in Source: setup.msi "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK" in Source: 00000000-00010656.00000000.159048.00640000.00000004.mdmp 00000000-00010656.00000001.160968.00640000.00000004.mdmp 00000000-00010656.00000002.162890.00640000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN" in Source: 00000000-00010656.00000000.159048.00640000.00000004.mdmp 00000000-00010656.00000001.160968.00640000.00000004.mdmp 00000000-00010656.00000002.162890.00640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00010656.00000000.159048.02770000.00000004.mdmp 00000000-00010656.00000001.160968.02770000.00000004.mdmp 00000000-00010656.00000002.162890.02770000.00000004.mdmp 00000000-00010656.00000002.162890.72551000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\" in Source: 00000000-00010656.00000000.159048.03256000.00000002.mdmp "Software\" in Source: 00000000-00010656.00000000.159048.03256000.00000002.mdmp3d:T1709,"taskcoach.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76690000 "taskcoach.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76690000 "taskcoach.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76690000 "taskcoach.exe" loaded module "KERNEL32" at base 74d00000 "taskcoach.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 716c0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\PYTHON27.DLL" at base 1e000000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\ZLIB.PYD" at base 0 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_HASHLIB.PYD" at base 10000000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_SOCKET.PYD" at base 21d0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_SSL.PYD" at base 25a0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 727e0000 "taskcoach.exe" loaded module "KERNEL32.DLL" at base 74d00000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._CORE_.PYD" at base 30b0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._GDI_.PYD" at base 36f0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._WINDOWS_.PYD" at base 4100000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._CONTROLS_.PYD" at base 4230000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._MISC_.PYD" at base 4330000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32API.PYD" at base 1e8c0000 "taskcoach.exe" loaded module "SECUR32.DLL" at base 726b0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\ZOPE.INTERFACE._ZOPE_INTERFACE_COPTIMIZATIONS.PYD" at base 692c0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\TWISTED.PYTHON._INITGROUPS.PYD" at base 4580000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_CTYPES.PYD" at base 1d1a0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\PYWINTYPES27.DLL" at base 1e7a0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32PROCESS.PYD" at base 1ebf0000 "taskcoach.exe" loaded module "PSAPI.DLL" at base 76390000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\SELECT.PYD" at base 1d110000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32FILE.PYD" at base 1ea10000 "taskcoach.exe" loaded module "SFC.DLL" at base 66680000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32EVENT.PYD" at base 1e9b0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32GUI.PYD" at base 1ea40000 "taskcoach.exe" loaded module "MSIMG32.DLL" at base 72690000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72c90000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74ca0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74490000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\PYTHONCOM27.DLL" at base 46e0000 "taskcoach.exe" loaded module "COMCTL32.DLL" at base 74a10000 "taskcoach.exe" loaded module "URLMON.DLL" at base 72550000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WIN32COM.SHELL.SHELL.PYD" at base 1e800000 "taskcoach.exe" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 722b0000 "taskcoach.exe" loaded module "RPCRT4.DLL" at base 75300000 "taskcoach.exe" loaded module "MSVCR90.DLL" at base 71710000 "taskcoach.exe" loaded module "RPCRT4" at base 75300000 "taskcoach.exe" loaded module "UXTHEME.DLL" at base 74490000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_WINXPTHEME.PYD" at base 1e3e0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._HTML.PYD" at base 57a0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 721f0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 721d0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 722a0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 721b0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 72190000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72180000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72120000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\BZ2.PYD" at base 1d170000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._GIZMOS.PYD" at base 5950000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._COMBO.PYD" at base 59f0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._GRID.PYD" at base 5a30000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\WX._WIZARD.PYD" at base 5ab0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\IGRAPH._IGRAPH.PYD" at base 5ae0000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\CAIRO._CAIRO.PYD" at base 5e90000 "taskcoach.exe" loaded module "%APPDATA%\KOQLPO CYNAV TOOL\_PYSYNCML.PYD" at base 5fd0000 "taskcoach.exe" loaded module "USER32.DLL" at base 75f30000 "taskcoach.exe" loaded module "DWMAPI.DLL" at base 71f10000 "taskcoach.exe" loaded module "COMCTL32" at base 74a10000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 71ec0000 "taskcoach.exe" loaded module "USER32" at base 75f30000 "taskcoach.exe" loaded module "GDI32.DLL" at base 760e0000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76db0000 "taskcoach.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 763a0000 "taskcoach.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75f30000 "taskcoach.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75f30000 "taskcoach.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76d30000 "taskcoach.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 750300003e:Tfab,"SELECT `Data` FROM `Binary` WHERE `Name` = '" (Source: setup.msi, Indicator: "select `data` from `binary` where `name` = '") "SELECT `Data` FROM `Binary` WHERE `Name` = 'viewer.exe'" (Source: setup.msi, Indicator: "select `data` from `binary` where `name` = 'viewer.exe'") "SELECT `Name`,`Event`,`ResetPeriod`,`RebootMessage`,`Command`,`Actions`,`DelayActions`,`Component_` FROM `AI_ServiceConfigFailureActions`" (Source: setup.msi, Indicator: "select `name`,`event`,`resetperiod`,`rebootmessage`,`command`,`actions`,`delayactions`,`component_` from `ai_serviceconfigfailureactions`") "SELECT `Text` FROM `Control` WHERE `Control`.`Dialog_`='%s' AND `Control`.`Control`='%s'" (Source: setup.msi, Indicator: "select `text` from `control` where `control`.`dialog_`='%s' and `control`.`control`='%s'") "SELECT `Registry`, `Root`,`Key`,`Name`,`Value`,`Component_` FROM `Registry` WHERE `Registry`.`Registry`=" (Source: setup.msi, Indicator: "select `registry`, `root`,`key`,`name`,`value`,`component_` from `registry` where `registry`.`registry`=") "INSERT INTO `" (Source: setup.msi, Indicator: "insert into `") "SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'" (Source: setup.msi, Indicator: "select * from `%s` where `property`='%s' and `value`='%s'") "SELECT * FROM `%s` WHERE `Property`='%s'" (Source: setup.msi, Indicator: "select * from `%s` where `property`='%s'") "SELECT `Message` FROM `Error` WHERE `Error` = %s" (Source: setup.msi, Indicator: "select `message` from `error` where `error` = %s") "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: setup.msi, Indicator: "select `text` from `uitext` where `key` = '%s'") "SELECT * FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'" (Source: setup.msi, Indicator: "select * from `control` where `dialog_` = '%s' and `control` = '%s'") "SELECT `Attributes` FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'" (Source: setup.msi, Indicator: "select `attributes` from `control` where `dialog_` = '%s' and `control` = '%s'") "SELECT `Attributes` FROM `Component` WHERE `Component` = '%s'" (Source: setup.msi, Indicator: "select `attributes` from `component` where `component` = '%s'") "SELECT `ActionProperty` FROM `Upgrade`" (Source: setup.msi, Indicator: "select `actionproperty` from `upgrade`") "DELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'" (Source: setup.msi, Indicator: "delete from `shortcut` where `shortcut`.`directory_`='%s'") "DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'" (Source: setup.msi, Indicator: "delete from `inifile` where `inifile`.`section`='internetshortcut' and`inifile`.`dirproperty`='%s'") "SELECT * FROM `%s`" (Source: setup.msi, Indicator: "select * from `%s`") "SELECT `Component` FROM `Component`" (Source: setup.msi, Indicator: "select `component` from `component`") "SELECT `Name` FROM `Binary` WHERE `Name` = '%s'" (Source: setup.msi, Indicator: "select `name` from `binary` where `name` = '%s'") "SELECT * FROM `Control` WHERE `Type` = 'Bitmap'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'bitmap'") "SELECT * FROM `Control` WHERE `Type` = 'Icon'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'icon'") "SELECT * FROM `Control` WHERE `Type` = 'PushButton'" (Source: setup.msi, Indicator: "select * from `control` where `type` = 'pushbutton'") "SELECT `Argument`, `Condition` FROM `ControlEvent` WHERE `Dialog_` = 'ExitDialog' AND `Control_` = 'Finish' AND `Event` = 'DoAction' ORDER BY `Ordering`" (Source: setup.msi, Indicator: "select `argument`, `condition` from `controlevent` where `dialog_` = 'exitdialog' and `control_` = 'finish' and `event` = 'doaction' order by `ordering`") "SELECT `Feature` FROM `Feature`" (Source: setup.msi, Indicator: "select `feature` from `feature`") "SELECT `UserName` FROM `AI_UserAccounts` WHERE `UserName` = ?" (Source: setup.msi, Indicator: "select `username` from `ai_useraccounts` where `username` = ?")3f:T5c6,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "setup.msi") Found reference to API "LoadLibrary(%s): failed to load." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "LoadLibrary(%s): loaded ok." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "LoadLibrary(%s): already loaded." (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "wxPluginManager::LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?LoadLibrary@wxPluginManager@@SAPAVwxPluginLibrary@@ABVwxString@@H@Z" (Indicator: "LoadLibrary"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")40:T4b8,"taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "taskcoach.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")41:Tae1,"taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "TASKCOACH.EXE"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "")42:T4b9,"taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "taskcoach.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "taskcoach.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "taskcoach.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "taskcoach.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9635_none_508ff82ebcbafee0\msvcr90.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "taskcoach.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll"43:T6c4,"taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\CRYPTSP.DLL" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\CRYPTBASE.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\WSOCK32.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\WINMM.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\VERSION.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\secur32.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\SSPICLI.DLL" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\MSWSOCK.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\sfc.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\sfc_os.DLL" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\msimg32.dll" "taskcoach.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\profapi.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\dwmapi.dll" "taskcoach.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Koqlpo Cynav Tool\TextShaping.dll"44:T40e,Found reference to API "setsockopt(level, optname, value) -- set socket options" (Indicator: "setsockopt"; Source: "00000000-00010656.00000000.159048.021D8000.00000004.mdmp, 00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found reference to API "setsockopt(level, option, value)" (Indicator: "setsockopt"; Source: "00000000-00010656.00000000.159048.021D8000.00000004.mdmp, 00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp")45:T452,Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "setup.msi") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "setup.msi") Found reference to API "NetGetDCName" (Indicator: "NetGetDCName"; File: "setup.msi") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "setup.msi") Found reference to API "NetLocalGroupGetInfo" (Indicator: "NetLocalGroupGetInfo"; File: "setup.msi") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; File: "setup.msi") Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; File: "setup.msi") Found reference to API "::NetGetDCName failed. Error:" (Indicator: "NetGetDCName"; File: "setup.msi") Found reference to API "NetUserGetInfo failed. Error:" (Indicator: "NetUserGetInfo"; File: "setup.msi") Found reference to API "NetUserModalsGet will use empty target computer name." (Indicator: "NetUserModalsGet"; File: "setup.msi") Found reference to API "NetUserModalsGet failed with:" (Indicator: "NetUserModalsGet"; File: "setup.msi")46:T13eb,Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentation" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20id%20verified%20cs%20aoc%20ca%2001.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20id%20verified%20cs%20aoc%20ca%2001.crt0-" Pattern match: "http://oneocsp.microsoft.com/ocsp0f" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20id%20verified%20code%20signing%20pca%202021.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20id%20verified%20code%20signing%20pca%202021.crt0-" Pattern match: "http://oneocsp.microsoft.com/ocsp0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20identity%20verification%20root%20certificate%20authority%202020.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20identity%20verification%20root%20certificate%20authority%202020.crt0-" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20identity%20verification%20root%20certificate%20authority%202020.crt0" Pattern match: "http://www.microsoft.com/pkiops/crl/microsoft%20public%20rsa%20timestamping%20ca%202020.crl0y" Pattern match: "http://www.microsoft.com/pkiops/certs/microsoft%20public%20rsa%20timestamping%20ca%202020.crt0" Pattern match: "http://schemas.microsoft.com/w" Pattern match: "http://schemas.microsoft.com/expression/blend/2008" Pattern match: "http://schemas.openxmlformats.org/markup-compatibility/2006" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Pattern match: "http://schemas.microsoft.com/client/2007" Heuristic match: "cbsnaturalway.com" Heuristic match: "taskcoach.org" Pattern match: "www.taskcoach.orgmessages.txt" Pattern match: "www.taskcoach.orgversion.txt" Heuristic match: "%appdata%\koqlpo cynav tool\library.zip\taskcoachlib\syncml\..\bin.in" Pattern match: "http://www.gnu.org/licenses/" Heuristic match: "??\c:\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us\wxstd.mo" Heuristic match: ":\users\hapubws\appdata\roaming\koqlpo cynav tool\en_us.windows-1252\wxmsw.mo" Heuristic match: ":\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us\wxstd.mo" Heuristic match: ":\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us\lc_messages\wxstd.mo" Heuristic match: ":\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us.windows-1252\wxstd.mo" Heuristic match: "??\c:\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us.windows-1252\wxstd.mo" Heuristic match: ":\users\hapubws\appdata\roaming\koqlpo cynav tool\locale\en_us.windows-1252\lc_messages\wxstd.mo" Heuristic match: "it0.lt" Heuristic match: "c:\python27\lib\site-packages\py2exe\boot_common.py" Pattern match: "myimport.zip/mydirectory" Heuristic match: "taskcoach@yahoogroups.com, python-announce-list@python.org" Pattern match: "http://taskcoach.org/screenshots/windows/0.71.2-windows_xp-tasks_categories_and_effort.png" Heuristic match: "copyright (c) 1999-2000, marc-andre lemburg; mailto:mal@lemburg.com" Heuristic match: "copyright (c) 2000-2010, egenix.com software gmbh; mailto:info@egenix.com" Heuristic match: "gntp.py" Pattern match: "https://sourceforge.net/tracker/?func=add&group_id=130831&atid=719134" Pattern match: "https://sourceforge.net/tracker/?group_id=130831&atid=719134&status=1" Pattern match: "https://answers.launchpad.net/taskcoach/+faqs" Pattern match: "https://translations.launchpad.net/taskcoach" Heuristic match: "developers@taskcoach.org" Pattern match: "http://taskcoach.org/" Heuristic match: "johnhaller@portableapps.com" Pattern match: "https://sourceforge.net/tracker/" Pattern match: "http://taskcoach.uservoice.com" Pattern match: "http://taskcoach.org/taskcoach.png" Pattern match: "http://taskcoach.org/pad.xml" Pattern match: "http://taskcoach.org/version.txt" Pattern match: "http://taskcoach.org/messages.txt" Pattern match: "http://taskcoach.org/download.html" Pattern match: "http://taskcoach.org/i18n.html" Pattern match: "https://sourceforge.net/tracker/?group_id=130831&atid=719135" Heuristic match: "taskcoachlib.meta.re" Pattern match: "http://downloads.sourceforge.net/taskcoach" Pattern match: "http://taskcoach.org/givesupport.html" Heuristic match: "t__.py" Heuristic match: "&b.py" Heuristic match: "'b.py" Heuristic match: "lib/keyword.py" Heuristic match: "__.py" Heuristic match: "se.py" Pattern match: "http://%s" Pattern match: "https://%s" Heuristic match: "command.com" Heuristic match: "ec.py" Heuristic match: "ct.py" Heuristic match: "ize.py" Heuristic match: "lib/token.py" Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" Heuristic match: "gio.py" Pattern match: "http://fsf.org/" Pattern match: "http://www.gnu.org/licenses/>" Pattern match: "http://www.gnu.org/philosophy/why-not-lgpl.html" Pattern match: "http://www.taskcoach.org/" Pattern match: "http://www.microsoft.com/whdc/ddk/debugging/" Heuristic match: "\command.com"47:T6054,Found URL "http://www.gnu.org/licenses/>.__main__(__doc__t" - Source: "00000000-00010656.00000000.159048.00407000.00000002.mdmp") Found URL "http://www.gnu.org/licenses/>.vq" - Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp") Found URL "http://taskcoach.org/screenshots/windows/0.71.2-windows_xp-tasks_categories_and_effort.pngunicodedata.pyowin32api.pyowin32cred.pyowin32event.pyowin32file.pyowin32gui.pyowin32pipe.pyowin32process.pyowin32security.pyowin32wnet.pyowx\_combo.pyowx\_controls_.pyowx\_core_.pyowx\_gdi_.pyowx\_gizmos.pyowx\_grid.pyowx\_html.pyowx\_misc_.pyowx\_windows_.pyowx\_wizard.pyotaskcoach.pyo_weakrefset.pyodateutil\easter.pyodateutil\parser.pyodateutil\rrule.pyodateutil\tz.pyodateutil\tzwin.pyogntp\__init__.pyokeyring\backend.pyokeyring\cli.pyokeyring\core.pyokeyring\errors.pyodecompressobjdef_mem_levelz_best_speedz_best_compressionz_huffman_onlyz_default_strategyz_sync_flushz_full_flushzlib_versionlinecache.pyolinecache.pyolinecache.pyolinecache.pyolinecache.pyo_get_exports_listc:\users\hapubws\appdata\roaming\koqlpo" - Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/>.askcjq" - Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/" - Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/.

tq" - Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?func=add&group_id=130831&atid=719134https://sourceforge.net/tracker/?group_id=130831&atid=719134&status=1copyright" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "https://answers.launchpad.net/taskcoach/+faqshttps://translations.launchpad.net/taskcoachfirst" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://taskcoach.org/johnhaller@portableapps.comtaskcoachlib\meta\debug.pyognu" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/http://taskcoach.uservoice.comlicense_title_and_version_abbrevtaskcoachlib.meta.taskcoachlibinternal:" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://taskcoach.org/taskcoach.pnghttp://taskcoach.org/pad.xmlhttp://taskcoach.org/version.txthttp://taskcoach.org/messages.txthttp://taskcoach.org/download.htmlhttp://taskcoach.org/i18n.html_developermessagechecker__settings_developermessagechecker__urlopenappdata.lnkdocreate%s.ini-old.lnk%s.inishutilmoveoldpathnewpathglobalpathsetvaluesettuplesetlistsetdictsetintgetvaluegettuplegetdictmessagebox'/mnlog_calltime_calllicensetextlicensehtmlcomposite1.4.6ressapril2019stablerevisionjanuaryfebruarymarchjunejulyaugustseptemberoctobernovemberdecemberstacksignaturetask" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?group_id=130831&atid=719135username=" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://downloads.sourceforge.net/taskcoachhttp://taskcoach.org/givesupport.htmlgnu" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://https://ftp://getheadersurlunparseurljoinmax_repeatsinf_msgurlpartsvisitedurllib2.pyonotifiedschemer_schemeauthorityuserinfohostportuserpasswordurllib2.pyo%s_open(?:.*,)*[" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://https://ftp://urllib.pyourllib.pyourllib.pyourllib.pyoretry__basic_authno" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://urllib.pyohttps://urllib.pyohttp://urllib.pyohttps://urllib.pyourllib.pyogetpassurllib.pyo_localhosturllib.pyo_thishosturllib.pyo_ftperrorsurllib.pyo_noheadersurllib.pyonoheadersrefcountkeepaliveurllib.pyobusyloginurllib.pyotype" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://%shttps://%sftp://%s_winregopenkeycloseproxyenableproxyserverurllib.pyourllib.pyorawhostfqdnurllib.pyourllib.pyowrong!urllib.pyototalsizeurllib.pyov]6[nturl2pathurllib////pressbad" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp") Found URL "http://www.microsoft.com/whdc/ddk/debugging/please" - Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found URL "http://..\..\src\msw\main.cppunexpected" - Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found URL "http://recursivelycookieonbegindrag_onleftdown_dragitemsdropitemdragitems_dragcolumnselectionshwindummy_itemonenddragondraggingresetcursor'/mnuser_prefprefs.jsuser_pref(librarythunderbirdh" - Source: "00000000-00010656.00000000.159048.047D0000.00000004.mdmp") Found URL "http://www.openssl.org/support/faq.html.....................\crypto\asn1\tasn_utl.c.\crypto\asn1\a_bitstr.c.\crypto\bn\bn_ctx.c.\crypto\bn\bn_gcd.c.\crypto\bn\bn_add.cx509_algorsalgorithmsx509_algorparameteropenssl" - Source: "00000000-00010656.00000000.159048.10029000.00000002.mdmp") Found URL "http://www.python.org/peps/pep-0263.html" - Source: "00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadd0.0n0t0c0m011181k1]1f1v1" - Source: "00000000-00010656.00000000.159048.1E8D9000.00000002.mdmp") Found URL "http://www.openssl.org/support/faq.html....................?.\crypto\bio\b_print.c0123456789abcdefdoapr().\crypto\ex_data.casn.1" - Source: "00000000-00010656.00000001.160968.02613000.00000002.mdmp") Found URL "http://www.gnu.org/licenses/>.vq" - Source: "00000000-00010656.00000001.160968.02670000.00000004.mdmp") Found URL "http://taskcoach.org/screenshots/windows/0.71.2-windows_xp-tasks_categories_and_effort.pngunicodedata.pyowin32api.pyowin32cred.pyowin32event.pyowin32file.pyowin32gui.pyowin32pipe.pyowin32process.pyowin32security.pyowin32wnet.pyowx\_combo.pyowx\_controls_.pyowx\_core_.pyowx\_gdi_.pyowx\_gizmos.pyowx\_grid.pyowx\_html.pyowx\_misc_.pyowx\_windows_.pyowx\_wizard.pyotaskcoach.pyo_weakrefset.pyodateutil\easter.pyodateutil\parser.pyodateutil\rrule.pyodateutil\tz.pyodateutil\tzwin.pyogntp\__init__.pyokeyring\backend.pyokeyring\cli.pyokeyring\core.pyokeyring\errors.pyodecompressobjdef_mem_levelz_best_speedz_best_compressionz_huffman_onlyz_default_strategyz_sync_flushz_full_flushzlib_versionlinecache.pyolinecache.pyolinecache.pyolinecache.pyolinecache.pyo_get_exports_listc:\users\hapubws\appdata\roaming\koqlpo" - Source: "00000000-00010656.00000001.160968.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/>.askcjq" - Source: "00000000-00010656.00000001.160968.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/" - Source: "00000000-00010656.00000001.160968.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/.

tq" - Source: "00000000-00010656.00000001.160968.02670000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?func=add&group_id=130831&atid=719134https://sourceforge.net/tracker/?group_id=130831&atid=719134&status=1copyright" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "https://answers.launchpad.net/taskcoach/+faqshttps://translations.launchpad.net/taskcoachfirst" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://taskcoach.org/johnhaller@portableapps.comtaskcoachlib\meta\debug.pyognu" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/http://taskcoach.uservoice.comlicense_title_and_version_abbrevtaskcoachlib.meta.taskcoachlibinternal:" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://taskcoach.org/taskcoach.pnghttp://taskcoach.org/pad.xmlhttp://taskcoach.org/version.txthttp://taskcoach.org/messages.txthttp://taskcoach.org/download.htmlhttp://taskcoach.org/i18n.html_developermessagechecker__settings_developermessagechecker__urlopenappdata.lnkdocreate%s.ini-old.lnk%s.inishutilmoveoldpathnewpathglobalpathsetvaluesettuplesetlistsetdictsetintgetvaluegettuplegetdictmessagebox'/mnlog_calltime_calllicensetextlicensehtmlcomposite1.4.6ressapril2019stablerevisionjanuaryfebruarymarchjunejulyaugustseptemberoctobernovemberdecemberstacksignaturetask" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?group_id=130831&atid=719135username=" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://downloads.sourceforge.net/taskcoachhttp://taskcoach.org/givesupport.htmlgnu" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://https://ftp://getheadersurlunparseurljoinmax_repeatsinf_msgurlpartsvisitedurllib2.pyonotifiedschemer_schemeauthorityuserinfohostportuserpasswordurllib2.pyo%s_open(?:.*,)*[" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://https://ftp://urllib.pyourllib.pyourllib.pyourllib.pyoretry__basic_authno" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://urllib.pyohttps://urllib.pyohttp://urllib.pyohttps://urllib.pyourllib.pyogetpassurllib.pyo_localhosturllib.pyo_thishosturllib.pyo_ftperrorsurllib.pyo_noheadersurllib.pyonoheadersrefcountkeepaliveurllib.pyobusyloginurllib.pyotype" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://%shttps://%sftp://%s_winregopenkeycloseproxyenableproxyserverurllib.pyourllib.pyorawhostfqdnurllib.pyourllib.pyowrong!urllib.pyototalsizeurllib.pyov]6[nturl2pathurllib////pressbad" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00010656.00000001.160968.02770000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txtlocation:" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txtyou" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txthttps://www.taskcoach.orgversion.txt/https://www.taskcoach.orgversion.txthttps://www.taskcoach.orgmessages.txthttps://www.taskcoach.orgmessages.txt/https://www.taskcoach.orgmessages.txt'nonetype'" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txtcontent-length:" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txtcontent-length:" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txt" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txt" - Source: "00000000-00010656.00000001.160968.05160000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespacexmlnsexternalpbm" - Source: "00000000-00010656.00000001.160968.05D61000.00000002.mdmp") Found URL "http://cairographics.org))" - Source: "00000000-00010656.00000001.160968.05F92000.00000002.mdmp") Found URL "http://cairographics.org))endobj" - Source: "00000000-00010656.00000001.160968.05F92000.00000002.mdmp") Found URL "http://cairographics.org)%%%%creationdate:" - Source: "00000000-00010656.00000001.160968.05F92000.00000002.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00010656.00000001.160968.05F92000.00000002.mdmp") Found URL "http://%shttps://https://http://http://dmtclientconfig(root):" - Source: "00000000-00010656.00000001.160968.0600D000.00000002.mdmp") Found URL "http://localhost:8080/funambol/dsguestworkstationfunambol-clienttext/x-s4j-sifnsnotenotetext/x-s4j-siftstasktasktext/x-s4j-sifescalcalendartext/x-vcardcardcontacttwo-wayslow,two-wayx-x-big5x-unicode-2-0-utf-8x-unicode-2-0-utf-7x-sjisx-ms-cp932x-mac-turkishx-mac-koreanx-mac-japanesex-mac-icelandicx-mac-hebrewx-mac-greekx-mac-cyrillicx-mac-chinesetradx-mac-chinesesimpx-mac-cex-mac-arabicx-iscii-tex-iscii-tax-iscii-pax-iscii-orx-iscii-max-iscii-kax-iscii-gux-iscii-dex-iscii-bex-iscii-asx-ia5-swedishx-ia5-norwegianx-ia5-germanx-ia5x-europax-euc-jpx-euc-cnx-eucx-ebcdic-uk-eurox-ebcdic-ukx-ebcdic-turkishx-ebcdic-traditionalchinesex-ebcdic-thaix-ebcdic-spain-eurox-ebcdic-spainx-ebcdic-simplifiedchinesex-ebcdic-koreanextendedx-ebcdic-koreanandkoreanextendedx-ebcdic-japanesekatakanax-ebcdic-japaneseanduscanadax-ebcdic-japaneseandkanax-ebcdic-japaneseandjapaneselatinx-ebcdic-italy-eurox-ebcdic-italyx-ebcdic-international-eurox-ebcdic-icelandic-eurox-ebcdic-icelandicx-ebcdic-hebrewx-ebcdic-greekmodernx-ebcdic-greekx-ebcdic-germany-eurox-ebcdic-germanyx-ebcdic-france-eurox-ebcdic-francex-ebcdic-finlandsweden-eurox-ebcdic-finlandswedenx-ebcdic-denmarknorway-eurox-ebcdic-denmarknorwayx-ebcdic-cyrillicserbianbulgarianx-ebcdic-cyrillicrussianx-ebcdic-cp-us-eurox-ebcdic-arabicx-cp1251x-cp1250x-chinese-etenx-chinese-cnsx-ansiwindows-874windows-1258windows-1257windows-1256windows-1255windows-1254windows-1253windows-1252windows-1251windows-1250visualutf-8utf-7utf-16us-asciiunicodefffeunicode-2-0-utf-8unicode-1-1-utf-8unicode-1-1-utf-7unicodetis-620shift_jisshift-jisms_kanjimacintoshlogicallatin9latin5latin4latin3latin2latin1ksc_5601ksc5601ks_c_5601_1987ks_c_5601-1989ks_c_5601-1987ks_c_5601koreankoi8rkoi8-ukoi8-rukoi8-rkoi8johabiso_8859-9:1989iso_8859-9iso_8859-8:1988iso_8859-8-iiso_8859-8iso_8859-7:1987iso_8859-7iso_8859-6:1987iso_8859-6iso_8859-5:1988iso_8859-5iso_8859-4:1988iso_8859-4iso_8859-3:1988iso_8859-3iso_8859-2:1987iso_8859-2iso_8859-1:1987iso_8859-15iso_8859-1iso_646.irv:1991iso8859-2iso8859-1iso646-usiso-ir-6usiso-ir-6iso-ir-58iso-ir-149iso-ir-148iso-ir-144iso-ir-138iso-ir-127iso-ir-126iso-ir-110iso-ir-109iso-ir-101iso-ir-100iso-8859-9iso-8859-8-iiso-8859-8iso-8859-7iso-8859-6iso-8859-5iso-8859-4iso-8859-3iso-8859-2iso-8859-15iso-8859-11iso-8859-1iso-2022-kriso-2022-jpibm869ibm866ibm861ibm857ibm852ibm850ibm819ibm775ibm737ibm437ibm367hz-gb-2312hebrewgreek8greekgb_2312-80gb231280gb2312-80gb2312euc-kreuc-jpeuc-cnelot_928ecma-118ecma-114ebcdic-cp-usdos-874dos-862dos-720cyrilliccswindows31jcsunicode11utf7csshiftjiscspc8csksc56011987cskoi8rcsisolatinhebrewcsisolatingreekcsisolatincyrilliccsisolatinarabiccsisolatin5csisolatin4csisolatin2csiso58gb231280csiso2022krcsiso2022jpcsisocsgb231280csgb2312cseucpkdfmtjapanesecseuckrcsbig5csasciicp870cp866cp852cp819cp500cp437cp367cp1256cp1026codepage437cn-gbcn-big5chinesebig5asmo-708asciiarabicansi_x3.4-1986ansi_x3.4-1968_iso-2022-jp$sio_iso-2022-jpinvalid" - Source: "00000000-00010656.00000001.160968.0600D000.00000002.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadda011_11/2a2" - Source: "00000000-00010656.00000001.160968.1E7BB000.00000002.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadd0%0/0<0e0n0w0_0e0k0p0v01o1x1a1i1o1u1z12l2q2c2h2n2z22-343;3o3o3" - Source: "00000000-00010656.00000001.160968.1E84C000.00000002.mdmp") Found URL "https://aloginnexusobjexushostrdr/pprdr.aspnexus.passport.comcbtxtburlromptailedetrynoretryrom-ppname" - Source: "00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found URL "http://file:/;expires=;domain=;secure_^[t\shell\open\commandtewvytvwvjnetscape.exe.htmpwwh@_^]falsej" - Source: "00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found URL "ftp://%s/qj.p9*uhaqf9dju" - Source: "00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found URL "http://%s/%swpad.datwpad.wpad" - Source: "00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found URL "http://www.gnu.org/licenses/>.vq" - Source: "00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found URL "http://taskcoach.org/screenshots/windows/0.71.2-windows_xp-tasks_categories_and_effort.pngunicodedata.pyowin32api.pyowin32cred.pyowin32event.pyowin32file.pyowin32gui.pyowin32pipe.pyowin32process.pyowin32security.pyowin32wnet.pyowx\_combo.pyowx\_controls_.pyowx\_core_.pyowx\_gdi_.pyowx\_gizmos.pyowx\_grid.pyowx\_html.pyowx\_misc_.pyowx\_windows_.pyowx\_wizard.pyotaskcoach.pyo_weakrefset.pyodateutil\easter.pyodateutil\parser.pyodateutil\rrule.pyodateutil\tz.pyodateutil\tzwin.pyogntp\__init__.pyokeyring\backend.pyokeyring\cli.pyokeyring\core.pyokeyring\errors.pyodecompressobjdef_mem_levelz_best_speedz_best_compressionz_huffman_onlyz_default_strategyz_sync_flushz_full_flushzlib_versionlinecache.pyolinecache.pyolinecache.pyolinecache.pyolinecache.pyo_get_exports_listc:\users\hapubws\appdata\roaming\koqlpo" - Source: "00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/>.askcjq" - Source: "00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/" - Source: "00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/.

tq" - Source: "00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?func=add&group_id=130831&atid=719134https://sourceforge.net/tracker/?group_id=130831&atid=719134&status=1copyright" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "https://answers.launchpad.net/taskcoach/+faqshttps://translations.launchpad.net/taskcoachfirst" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://taskcoach.org/johnhaller@portableapps.comtaskcoachlib\meta\debug.pyognu" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/http://taskcoach.uservoice.comlicense_title_and_version_abbrevtaskcoachlib.meta.taskcoachlibinternal:" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://taskcoach.org/taskcoach.pnghttp://taskcoach.org/pad.xmlhttp://taskcoach.org/version.txthttp://taskcoach.org/messages.txthttp://taskcoach.org/download.htmlhttp://taskcoach.org/i18n.html_developermessagechecker__settings_developermessagechecker__urlopenappdata.lnkdocreate%s.ini-old.lnk%s.inishutilmoveoldpathnewpathglobalpathsetvaluesettuplesetlistsetdictsetintgetvaluegettuplegetdictmessagebox'/mnlog_calltime_calllicensetextlicensehtmlcomposite1.4.6ressapril2019stablerevisionjanuaryfebruarymarchjunejulyaugustseptemberoctobernovemberdecemberstacksignaturetask" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "https://sourceforge.net/tracker/?group_id=130831&atid=719135username=" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://downloads.sourceforge.net/taskcoachhttp://taskcoach.org/givesupport.htmlgnu" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://https://ftp://getheadersurlunparseurljoinmax_repeatsinf_msgurlpartsvisitedurllib2.pyonotifiedschemer_schemeauthorityuserinfohostportuserpasswordurllib2.pyo%s_open(?:.*,)*[" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://https://ftp://urllib.pyourllib.pyourllib.pyourllib.pyoretry__basic_authno" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://urllib.pyohttps://urllib.pyohttp://urllib.pyohttps://urllib.pyourllib.pyogetpassurllib.pyo_localhosturllib.pyo_thishosturllib.pyo_ftperrorsurllib.pyo_noheadersurllib.pyonoheadersrefcountkeepaliveurllib.pyobusyloginurllib.pyotype" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://%shttps://%sftp://%s_winregopenkeycloseproxyenableproxyserverurllib.pyourllib.pyorawhostfqdnurllib.pyourllib.pyowrong!urllib.pyototalsizeurllib.pyov]6[nturl2pathurllib////pressbad" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpad2r2" - Source: "00000000-00010656.00000002.162890.0473A000.00000002.mdmp") Found URL "https://www.taskcoach.orgversion.txtlocation:" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txtyou" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txthttps://www.taskcoach.orgversion.txt/https://www.taskcoach.orgversion.txthttps://www.taskcoach.orgmessages.txthttps://www.taskcoach.orgmessages.txt/https://www.taskcoach.orgmessages.txt'nonetype'" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txtcontent-length:" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txtcontent-length:" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgversion.txt" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "https://www.taskcoach.orgmessages.txt" - Source: "00000000-00010656.00000002.162890.05160000.00000004.mdmp") Found URL "http://arxiv.org/abs/physics/0512106" - Source: "00000000-00010656.00000002.162890.05E02000.00000004.mdmp") Found URL "http://graphml.graphdrawing.org/xmlns" - Source: "00000000-00010656.00000002.162890.05E39000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00010656.00000002.162890.05E39000.00000004.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadd0e0r0e00w1o13(3,30343787b88]9f9:1:h:;" - Source: "00000000-00010656.00000002.162890.1EA2E000.00000002.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadd5g5c5" - Source: "00000000-00010656.00000002.162890.1EA67000.00000002.mdmp") Found URL "http://pywin32.sourceforge.netproductnamepywin32varfileinfotranslationpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpaddingxxpaddingpadd0.0a02" - Source: "00000000-00010656.00000002.162890.1EBFA000.00000002.mdmp") Found URL "http://www.passport.com" - Source: "00000000-00010656.00000002.162890.720E9000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=129221&check=check&hide_type=all&summary=on&uri=%url%ttp://go.microsoft.com/fwlink/?linkid=129219ttp://go.microsoft.com/fwlink/?linkid=129218ttp://go.microsoft.com/fwlink/?linkid=129220&url=%url%http://go.microsoft.com/fwlink/?linkid=129217&profile=css2&warning=2&uri=%url%ttp://go.microsoft.com/fwlink/?linkid=129216&verbose=1&uri=%url%strarray1strarray2strarray3strarray4strarray5%windir%\testhttp://test.com128,0,1280,0,2550,0,0192,192,192doctypepreservettps://go.microsoft.com/fwlink/?linkid=141260rdparty.html7.0.5331.0ttp://go.microsoft.com/fwlink/?linkid=69157nableoftwareoftware\policiessoftware\policies\microsoft\windows\currentversion\internet" - Source: "00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found URL "http://purl.org/rss/1.0/http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found URL "http://www.microsoft.com/schemas/ie8tldlistdescription/1.0" - Source: "00000000-00010656.00000002.162890.72627000.00000002.mdmp")48:T503,"taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\config (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\meta (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\thirdparty (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\patterns (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\thirdparty\desktop (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\thirdparty\pubsub (UID: 00000000-00010656) "taskcoach.exe" called "FindFirstFileA" with parameter %APPDATA%\Koqlpo Cynav Tool\library.zip\taskcoachlib\thirdparty\pubsub\core (UID: 00000000-00010656)49:T1a09,Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\base64.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\email\base64mime.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "base64.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "tarfile.pyo" (Indicator: "tarfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "zipfile.pyo" (Indicator: "zipfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "email\base64mime.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "encodings\base64_codec.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.1E206000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.1E206000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.1E206000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.1E206000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\encodings\base64_codec.pyo" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\tarfile.pyo" (Indicator: "tarfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\zipfile.pyo" (Indicator: "zipfile"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "WSAESHUTDOWN" (Indicator: "aes"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp") Found string "WSAESOCKTNOSUPPORT" (Indicator: "aes"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "WSAESTALE" (Indicator: "aes"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "Non-base32 digit found" (Indicator: "base32"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "standard_b64decode" (Indicator: "b64decode"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "urlsafe_b64decode" (Indicator: "b64decode"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "b64decode" (Indicator: "b64decode"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "b2a_base64" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "a2b_base64" (Indicator: "base64"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "bad zipfile offset to entry" (Indicator: "zipfile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")4a:T61c,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "setup.msi") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "setup.msi") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "setup.msi") Found reference to API "You must call wxFindFirstFile before!" (Indicator: "FindFirstFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "wxFindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp") Found reference to API "?wxFindFirstFile@@YA?AVwxString@@PB_WH@Z" (Indicator: "FindFirstFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "?wxFindNextFile@@YA?AVwxString@@XZ" (Indicator: "FindNextFile"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")4b:T1d2b,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "setup.msi") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; File: "setup.msi") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "setup.msi") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "setup.msi") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "setup.msi") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "setup.msi") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "setup.msi") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "setup.msi") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "setup.msi") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "setup.msi") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")4c:T91a,Found reference to API "RegOpenKeyTransactedW" (Indicator: "RegOpenKey"; File: "setup.msi") Found reference to API "RegOpenKeyTransactedW" (Indicator: "RegOpenKeyTransacted"; File: "setup.msi") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "setup.msi") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "setup.msi") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "setup.msi") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; File: "setup.msi") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "setup.msi") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "setup.msi") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")4d:T56b,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "setup.msi") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")4e:T92f,Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")4f:T116c,Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "setup.msi") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "setup.msi") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "setup.msi") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "setup.msi") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "setup.msi") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "setup.msi") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "setup.msi") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "setup.msi") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "?wxGetTempFileName@@YAPA_WABVwxString@@PA_W@Z" (Indicator: "GetTempFileName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp") Found reference to API "?wxGetTempFileName@@YA_NABVwxString@@AAV1@@Z" (Indicator: "GetTempFileName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")50:T977,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "setup.msi") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")51:Taef,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "setup.msi") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "setup.msi") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "setup.msi") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "setup.msi") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "setup.msi") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "setup.msi") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "setup.msi") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "setup.msi") Found reference to API "NetUserGetInfo failed. Error:" (Indicator: "NetUserGetInfo"; File: "setup.msi") Found reference to API "LookupAccountSidW returned" (Indicator: "LookupAccountSid"; File: "setup.msi") Found reference to API "LookupAccountSidW( "%s" ) --> Username="%s" Domain="%s"" (Indicator: "LookupAccountSid"; File: "setup.msi") Found reference to API "LookupAccountSidW() FAILED" (Indicator: "LookupAccountSid"; File: "setup.msi") Found reference to API "LookupAccountSid( %s ) --> Username=%s Domain=%s" (Indicator: "LookupAccountSid"; File: "setup.msi") Found reference to API "empty buffer in wxGetUserName" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "wxGetUserName" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "?GetUserNameW@wxTarEntry@@QBE?AVwxString@@XZ" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "?wxGetUserName@@YA?AVwxString@@XZ" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp") Found reference to API "?wxGetUserName@@YA_NPA_WH@Z" (Indicator: "GetUserName"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp")52:T857,Found string "taskcoachlib\widgets\password.pyo" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\library.zip\taskcoachlib\widgets\password.pyo" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "add_password" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "find_user_password" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "password_mgr" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "Enter password for %s in %s at %s:" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp") Found string "source code form), and must require no special password or key for" (Indicator: "password"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp")53:Td16,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00009060-00000BC0-1488874047") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00010656.00000000.159048.00640000.00000004.mdmp, 00000000-00010656.00000000.159048.02290000.00000004.mdmp, 00000000-00010656.00000000.159048.02660000.00000004.mdmp, 00000000-00010656.00000001.160968.00640000.00000004.mdmp, 00000000-00010656.00000001.160968.02290000.00000004.mdmp, 00000000-00010656.00000001.160968.02660000.00000004.mdmp, 00000000-00010656.00000002.162890.00640000.00000004.mdmp, 00000000-00010656.00000002.162890.02290000.00000004.mdmp, 00000000-00010656.00000002.162890.02660000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00010656.00000000.159048.00640000.00000004.mdmp, 00000000-00010656.00000000.159048.02290000.00000004.mdmp, 00000000-00010656.00000000.159048.02660000.00000004.mdmp, 00000000-00010656.00000001.160968.00640000.00000004.mdmp, 00000000-00010656.00000001.160968.02290000.00000004.mdmp, 00000000-00010656.00000001.160968.02660000.00000004.mdmp, 00000000-00010656.00000002.162890.00640000.00000004.mdmp, 00000000-00010656.00000002.162890.02290000.00000004.mdmp, 00000000-00010656.00000002.162890.02660000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Users\HAPUBWS\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe" (Indicator: "\Device\"; Source: "00000000-00010656.00000000.159048.00640000.00000004.mdmp, 00000000-00010656.00000001.160968.00640000.00000004.mdmp, 00000000-00010656.00000002.162890.00640000.00000004.mdmp") Found string "o)tverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00010656.00000000.159048.02660000.00000004.mdmp, 00000000-00010656.00000001.160968.02660000.00000004.mdmp, 00000000-00010656.00000002.162890.02660000.00000004.mdmp") Found string "o)tverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00010656.00000000.159048.02660000.00000004.mdmp, 00000000-00010656.00000001.160968.02660000.00000004.mdmp, 00000000-00010656.00000002.162890.02660000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00010656.00000000.159048.02670000.00000004.mdmp, 00000000-00010656.00000001.160968.02670000.00000004.mdmp, 00000000-00010656.00000002.162890.02670000.00000004.mdmp")54:T445,Found reference to API "RegDeleteKeyTransactedW" (Indicator: "RegDeleteKeyTransacted"; File: "setup.msi") Found reference to API "RegDeleteKeyTransactedW" (Indicator: "RegDeleteKey"; File: "setup.msi") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "setup.msi") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "setup.msi") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "setup.msi") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")55:T429,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "setup.msi") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "setup.msi") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "setup.msi") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "setup.msi") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "setup.msi") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp")56:T6dc,Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "setup.msi") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "setup.msi") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "setup.msi") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "setup.msi") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "setup.msi") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "setup.msi") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "setup.msi") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "setup.msi") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "setup.msi") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "setup.msi") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "setup.msi") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "setup.msi") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "setup.msi") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "setup.msi") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "setup.msi") Found reference to API "AllocateAndInitializeSid failed and returned" (Indicator: "AllocateAndInitializeSid"; File: "setup.msi") Found reference to API "AllocateAndInitializeSid failed and returned" (Indicator: "InitializeSid"; File: "setup.msi")57:Tbd9,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "setup.msi") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "setup.msi") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "setup.msi") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.041E4000.00000002.mdmp, 00000000-00010656.00000000.159048.042A2000.00000002.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000000.159048.1E3E3000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02240000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.0374F000.00000002.mdmp, 00000000-00010656.00000001.160968.05974000.00000002.mdmp, 00000000-00010656.00000001.160968.05A00000.00000002.mdmp, 00000000-00010656.00000001.160968.05ABB000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1D112000.00000002.mdmp, 00000000-00010656.00000001.160968.1D1AC000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.00404000.00000002.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.0367E000.00000002.mdmp, 00000000-00010656.00000002.162890.0414F000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp, 00000000-00010656.00000002.162890.04714000.00000002.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.059CE000.00000002.mdmp, 00000000-00010656.00000002.162890.05A5F000.00000002.mdmp, 00000000-00010656.00000002.162890.1D17B000.00000002.mdmp, 00000000-00010656.00000002.162890.1E82D000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp")58:T9c8,"taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "taskcoach.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")59:T4fb,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "setup.msi") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp") Found reference to API "CreateMutex()" (Indicator: "CreateMutex"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "ReleaseMutex()" (Indicator: "ReleaseMutex"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.1E9B4000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp")5a:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=5b:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790535649122,"unified_at":"2026-09-27T19:00:49.122Z","metadata":{"hashes":{"sha256":"9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41","sha1":"950accb24de4bbc9b3f29fb462311dcb54e6e6b2","md5":"674652ba6a8e5bff5f9566bb4a68b649","sha512":"660ecfca0a0e39e5c1a39e8f75f530b5dc4a0f59640bc6361fef190f464d18541ff23c018b6f711718e7071d2a8e59c88cc89636caf531fa533ebcb18da403a3","ssdeep":"1572864:VlP7ZdJuUgI3OTZkmcFpX/kyYM0iY5L3Hh7vuTPXXLrB:NPbFpX0iJ/Xn","ssdeep_chunks":["1572864:VlP7ZdJ","1572864:lP7ZdJu","1572864:P7ZdJuU","1572864:7ZdJuUg","1572864:ZdJuUgI","1572864:dJuUgI3","1572864:JuUgI3O","1572864:uUgI3OT","1572864:UgI3OTZ","1572864:gI3OTZk","1572864:I3OTZkm","1572864:3OTZkmc","1572864:OTZkmcF","1572864:TZkmcFp","1572864:ZkmcFpX","1572864:kmcFpX/","1572864:mcFpX/k","1572864:cFpX/ky","1572864:FpX/kyY","1572864:pX/kyYM","1572864:X/kyYM0","1572864:/kyYM0i","1572864:kyYM0iY","1572864:yYM0iY5","1572864:YM0iY5L","1572864:M0iY5L3","1572864:0iY5L3H","1572864:iY5L3Hh","1572864:Y5L3Hh7","1572864:5L3Hh7v","1572864:L3Hh7vu","1572864:3Hh7vuT","1572864:Hh7vuTP","1572864:h7vuTPX","1572864:7vuTPXX","1572864:vuTPXXL","1572864:uTPXXLr","1572864:TPXXLrB","3145728:VlP7ZdJ","3145728:lP7ZdJu","3145728:P7ZdJuU","3145728:7ZdJuUg","3145728:ZdJuUgI","3145728:dJuUgI3","3145728:JuUgI3O","3145728:uUgI3OT","3145728:UgI3OTZ","3145728:gI3OTZk","3145728:I3OTZkm","3145728:3OTZkmc","3145728:OTZkmcF","3145728:TZkmcFp","3145728:ZkmcFpX","3145728:kmcFpX/","3145728:mcFpX/k","3145728:cFpX/ky","3145728:FpX/kyY","3145728:pX/kyYM","3145728:X/kyYM0","3145728:/kyYM0i","3145728:kyYM0iY","3145728:yYM0iY5","3145728:YM0iY5L","3145728:M0iY5L3","3145728:0iY5L3H","3145728:iY5L3Hh","3145728:Y5L3Hh7","3145728:5L3Hh7v","3145728:L3Hh7vu","3145728:3Hh7vuT","3145728:Hh7vuTP","3145728:h7vuTPX","3145728:7vuTPXX","3145728:vuTPXXL","3145728:uTPXXLr","3145728:TPXXLrB","1572864:NPbFpX0","1572864:PbFpX0i","1572864:bFpX0iJ","1572864:FpX0iJ/","1572864:pX0iJ/X","1572864:X0iJ/Xn"],"imphash":"Unknown"},"file_info":{"file_name":"setup.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":74339328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1746816937000,"last_seen":1769338018000,"last_multi_scan":1769338018000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":194,"suspicious_count":7,"malicious_count":3,"total":204},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"malicious","value":"Found more than one unique user-agent"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"taskcoach.exe\" called \"FindResourceA\" with parameter \"1\" - (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"taskcoach.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4223400'}\" (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"taskcoach.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\TaskCoach (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"setup.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"setup.msi\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"setup.msi\")\n Found reference to API \"CreateThread in wxExecute\" (Indicator: \"CreateThread\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")\n Found reference to API \"?wxGetFreeMemory@@YA?AVwxLongLongNative@@XZ\" (Indicator: \"FreeMemory\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"setup.msi\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"setup.msi\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"setup.msi\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"setup.msi\")\n Found reference to API \"Failed to OpenService. Error code:\" (Indicator: \"OpenService\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.10029000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00010656.00000001.160968.02770000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"setup.msi\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"setup.msi\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"setup.msi\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"setup.msi\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"standard_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"urlsafe_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"setup.msi\")\n Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00010656.00000000.159048.00640000.00000004.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup.msi\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"setup.msi\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00010656-00000C2A-1491247454\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00010656-00000C2A-1491246503\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"taskcoach.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"taskcoach.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"taskcoach.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"taskcoach.exe\" called \"IsWow64Process\" with parameter \"10656\" - (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2d","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"taskcoach.exe\" called \"GetActiveWindow\" (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"taskcoach.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"taskcoach.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"setup.msi\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"setup.msi\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `%s` WHERE `Property`='%s'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `%s`\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `Control` WHERE `Type` = 'Bitmap'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `Control` WHERE `Type` = 'Icon'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `Control` WHERE `Type` = 'PushButton'\" (Indicator: \"select * from \"; File: \"setup.msi\")\n Found string \"SELECT * FROM `Condition` WHERE `Condition`.`Feature_`='\" (Indicator: \"select * from \"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"taskcoach.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"tpm2emu.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"setup.msi\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"setup.msi\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"setup.msi\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1EA5B000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"setup.msi\")\n Found reference to API \"GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"taskcoach.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rofgrw\" at 00000000-00010656-00000C16-1496254427\n \"taskcoach.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpqyio7m.png\" at 00000000-00010656-00000C16-1496259786\n \"taskcoach.exe\" queries volume information of \"C:\\Users\\Default\\AppData\\Roaming\\Task Coach\\templates\\dueToday.tsktmpl\" at 00000000-00010656-00000C16-1501370703\n \"taskcoach.exe\" queries volume information of \"C:\\Users\\Default\\AppData\\Roaming\\Task Coach\\templates\\dueTomorrow.tsktmpl\" at 00000000-00010656-00000C16-1501372961","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"taskcoach.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"taskcoach.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"setup.msi\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"setup.msi\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"setup.msi\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"taskcoach.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Task Coach (UID: 00000000-00010656)\n \"taskcoach.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Task Coach\\templates (UID: 00000000-00010656)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cbsnaturalway.com\"\n \"taskcoach.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"138.199.40.58:443\"\n \"51.158.149.82:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\ReleaseAI\\win\\Release\\custact\\x86\\AICustAct.pdb\"\n \"C:\\ReleaseAI\\win\\Release\\custact\\x86\\DataUploader.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$38","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"setup.msi\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKey\"; File: \"setup.msi\")\n Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKeyTransacted\"; File: \"setup.msi\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"setup.msi\")\n Found reference to API \"RegLoadKeyW\" (Indicator: \"RegLoadKey\"; File: \"setup.msi\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"setup.msi\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")\n Found reference to API \"?CreateFileType@wxMimeTypesManagerImpl@@QAEPAVwxFileType@@ABVwxString@@0@Z\" (Indicator: \"CreateFile\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"setup.msi\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"setup.msi\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.1E7AD000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"setup.msi\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"setup.msi\")\n Found reference to API \"::ShellExecuteEx() call failed with error code:\" (Indicator: \"ShellExecute\"; File: \"setup.msi\")\n Found reference to API \"SE_ERR_FNF from ShellExecute -- maybe FireFox?\" (Indicator: \"ShellExecute\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"setup.msi\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"setup.msi\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"setup.msi\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"setup.msi\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"setup.msi\")\n Found reference to API \"LogonUser API returned:\" (Indicator: \"LogonUser\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"setup.msi\")\n Found reference to API \"FileUtil::MoveFile : SHFileOperation returned\" (Indicator: \"MoveFile\"; File: \"setup.msi\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"setup.msi\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup.msi\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"setup.msi\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1EBF6000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"setup.msi\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"FileUtil::MoveFile : SHFileOperation returned\" (Indicator: \"SHFileOperation\"; File: \"setup.msi\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:10656:168:WilStaging_02\"\n \"Local\\SM0:10656:64:WilError_03\"\n \"SM0:10656:64:WilError_03\"\n \"DBWinMutex\"\n \"TaskCoach\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"taskcoach.exe\" failed to load missing module \"%APPDATA%\\Koqlpo Cynav Tool\\zlib.pyd\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\ToServer","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D0B10000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D15A0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75290000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 722A0000\n \"taskcoach.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75290000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 93F90000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D38F0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75300000\n \"taskcoach.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75300000\n \"tpm2emu.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D38F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"taskcoach.exe\" called \"WScript.Shell.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"setup.msi\" was detected as \"Microsoft Compound\" and name: \"Archive\"\n \"setup.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"taskcoach.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00009060-00000BC0-1488874047]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00005764) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00000000-00005764) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, EFC_5528, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE\"\n Process \"MsiExec.exe\" (UID: 00000000-00008332) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-8LD9T6N\", LOGONSERVER=\"\\\\DESKTOP-8LD9T6N\", kIzf6MQk=\"C:\\Users\\%OSUSER%\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\FY29w6t\", HOMEDRIVE=\"C:\"\"\n Process \"MsiExec.exe\" (UID: 00000000-00008332) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cbsnaturalway.com\"\n \"taskcoach.org\"\n \"www.taskcoach.orgmessages.txt\"\n \"www.taskcoach.orgversion.txt\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"taskcoach.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"taskcoach.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"taskcoach.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"taskcoach.exe\" searching for window \"Snarl\"\n \"taskcoach.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"taskcoach.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 9056","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005764)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 8F6CC9054D4F52CD553E6739F38D882C\" (UID: 00000000-00008332)\n Spawned process \"taskcoach.exe\" (UID: 00000000-00010656)\n Spawned process \"tpm2emu.exe\" with commandline \"0\" (UID: 00000000-00009060)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005764)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 8F6CC9054D4F52CD553E6739F38D882C\" (UID: 00000000-00008332)\n Spawned process \"taskcoach.exe\" (UID: 00000000-00010656)\n Spawned process \"tpm2emu.exe\" with commandline \"0\" (UID: 00000000-00009060)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R11, O=Let's Encrypt, C=US\" (SHA1: CF:58:BF:86:7C:C5:FB:71:46:BE:20:10:46:15:A9:D8:45:A6:15:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 69:6D:B3:AF:0D:FF:C1:7E:65:C6:A2:0D:92:5C:5A:7B:D2:4D:EC:7E; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: CA:BD:2A:79:A1:07:6A:31:F2:1D:25:36:35:CB:03:9D:43:29:A5:E8; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"taskcoach.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rofgrw\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"taskcoach.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dueTomorrow.tsktmpl\" has type \"XML 1.0 document ASCII text\"- Location: [%APPDATA%\\Task Coach\\templates\\dueTomorrow.tsktmpl]- [targetUID: 00000000-00010656]\n \"dueToday.tsktmpl\" has type \"XML 1.0 document ASCII text\"- Location: [%APPDATA%\\Task Coach\\templates\\dueToday.tsktmpl]- [targetUID: 00000000-00010656]\n \"rofgrw\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\rofgrw]- [targetUID: 00000000-00010656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"dueTomorrow.tsktmpl\" has type \"XML 1.0 document ASCII text\" - Location: [%APPDATA%\\Task Coach\\templates\\dueTomorrow.tsktmpl]\n \"dueToday.tsktmpl\" has type \"XML 1.0 document ASCII text\" - Location: [%APPDATA%\\Task Coach\\templates\\dueToday.tsktmpl]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"taskcoach.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\taskcoach.exe\" (UID: 10656)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"taskcoach.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\koqlpo cynav tool\\library.zip\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\taskcoach.exe.Local\\\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\zlib.pyd\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\tzres.dll.mui\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\WINSPOOL.DRV\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\TaskCoach\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\TaskCoach.ini\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\Default\\AppData\\Roaming\\Task Coach\\TaskCoach.ini\"\n \"taskcoach.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Koqlpo Cynav Tool\\locale\\wxstd.mo\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"taskcoach.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rofgrw\"\n \"taskcoach.exe\" writes file \"c:\\users\\default\\appdata\\roaming\\task coach\\templates\\duetoday.tsktmpl\"\n \"taskcoach.exe\" writes file \"c:\\users\\default\\appdata\\roaming\\task coach\\templates\\duetomorrow.tsktmpl\"\n \"taskcoach.exe\" writes file \"%appdata%\\task coach\\templates\\duetomorrow.tsktmpl\"\n \"taskcoach.exe\" writes file \"%appdata%\\task coach\\templates\\duetoday.tsktmpl\"\n \"taskcoach.exe\" writes file \"%temp%\\rofgrw\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00010656-00000C2A-1491246656\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /diagnostics.php\"\n Found http requests in header \"GET /version.txt\"\n Found http requests in header \"GET /messages.txt\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.02613000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"setup.msi\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"setup.msi\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"22.6.0.0\"\n Potential IP \"255.255.255.255\" found in string \"Return the IP address (a string of the form '255.255.255.255') for a host.\"\n Potential IP \"123.45.67.89\" found in string \"Convert an IP address in string format (123.45.67.89) to the 32-bit packed\"\n \"3.0.0.0\"\n Potential IP \"3.0.0.0\" found in string \"3.0.0.0-unicode\"\n \"127.0.0.1\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\regc_lex.c\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\regc_color.c\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\regc_nfa.c\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\regc_cvec.c\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\regc_locale.c\"\n Potential IP \"2.8.12.1\" found in string \"c:\\build\\wxpython-src-2.8.12.1\\src\\regex\\rege_dfa.c\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"CONNECT %s:%d HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /version.txt HTTP/1.1\nAccept-Encoding: identity\nHost: taskcoach.org\nConnection: close\nUser-Agent: Python-urllib/2.7\n\n GET /messages.txt HTTP/1.1\nAccept-Encoding: identity\nHost: taskcoach.org\nConnection: close\nUser-Agent: Python-urllib/2.7\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cbsnaturalway.com\" has high entropy\n Contacted domain: \"www.taskcoach.orgmessages.txt\" has high entropy\n Contacted domain: \"www.taskcoach.orgversion.txt\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"cbsnaturalway.com\" (1 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"Observed string: \"OpenSSL 0.9.8l 5 Nov 2009\" (Indicator: \"OpenSSL 0.\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://cbsnaturalway.com/diagnostics.php","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"cbsnaturalway.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"138.199.40.58\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"setup.msi\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"sftp\" (Indicator: \"sftp\") in Source: 00000000-00010656.00000000.159048.02770000.00000004.mdmp\n 00000000-00010656.00000001.160968.02770000.00000004.mdmp\n 00000000-00010656.00000002.162890.02770000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"taskcoach.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10ae1\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"taskcoach.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"107b5\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"taskcoach.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10b1a\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"taskcoach.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"NetGetDCName\" (Indicator: \"GetDC\"; File: \"setup.msi\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"setup.msi\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"setup.msi\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"setup.msi\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"setup.msi\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"setup.msi\")\n Found reference to API \"::NetGetDCName failed. Error:\" (Indicator: \"GetDC\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.03481000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"setup.msi\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.057C8000.00000002.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"setup.msi\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"setup.msi\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.05F92000.00000002.mdmp, 00000000-00010656.00000001.160968.0600D000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where to find the applicable terms.

\" (Indicator: \"where \"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found string \"where to find the applicable terms.\" (Indicator: \"where \"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir must be opened before traversing it\" (Indicator: \"dir \"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"setup.msi\")\n Found reference to API \"?wxGetProcessId@@YAKXZ\" (Indicator: \"GetProcessId\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.0438B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"setup.msi\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.03127000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname() -> string\" (Indicator: \"gethostname\"; Source: \"00000000-00010656.00000000.159048.021D8000.00000004.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00010656.00000000.159048.021D8000.00000004.mdmp, 00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"getsockname() -> address info\" (Indicator: \"getsockname\"; Source: \"00000000-00010656.00000000.159048.021D8000.00000004.mdmp, 00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.021D6000.00000002.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$52","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"setup.msi\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"setup.msi\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000000.159048.1E0FE000.00000002.mdmp, 00000000-00010656.00000001.160968.05D61000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"setup.msi\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format message error [win32 error 0x\" (Indicator: \"format \"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00010656.00000000.159048.02770000.00000004.mdmp\n 00000000-00010656.00000001.160968.021D6000.00000002.mdmp\n 00000000-00010656.00000001.160968.02613000.00000002.mdmp\n 00000000-00010656.00000001.160968.02770000.00000004.mdmp\n 00000000-00010656.00000001.160968.72031000.00000020.mdmp\n 00000000-00010656.00000002.162890.02770000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"setup.msi\")\n Found reference to API \"SeServiceLogonRight\" (Indicator: \"SeServiceLogonRight\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"setup.msi\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.72031000.00000020.mdmp, 00000000-00010656.00000002.162890.1EA23000.00000002.mdmp, 00000000-00010656.00000002.162890.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"taskcoach.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"setup.msi\")\n Found reference to API \"NetApiBufferFree return:\" (Indicator: \"NetApiBufferFree\"; File: \"setup.msi\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000001.160968.1E8CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"dueTomorrow.tsktmpl\" - Location: [%APPDATA%\\Task Coach\\templates\\dueTomorrow.tsktmpl]- [targetUID: 00000000-00010656]\n Dropped file: \"dueToday.tsktmpl\" - Location: [%APPDATA%\\Task Coach\\templates\\dueToday.tsktmpl]- [targetUID: 00000000-00010656]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"taskcoach.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"Dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"setup.msi\")\n Found string \"Latest dbghelp.dll is available at http://www.microsoft.com/whdc/ddk/debugging/\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")\n Found string \"Please install dbghelp.dll available free of charge from Microsoft to get more detailed crash information!\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")\n Found string \"Please update your dbghelp.dll version, at least version 5.1 is needed!\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00010656.00000000.159048.03256000.00000002.mdmp, 00000000-00010656.00000002.162890.72361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /diagnostics.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\nUser-Agent: AdvancedInstaller\nHost: cbsnaturalway.com\nContent-Length: 79\nCache-Control: no-cache\" with payload::==> \"44:61:74:65:3d:35:25:32:46:39:25:32:46:32:30:32:35:26:50:72:6f:64:75:63:74:49:44:3d:26:57:69:6e:64:6f:77:73:42:75:69:6c:64:3d:32:32:36:32:31:26:56:65:72:73:69:6f:6e:4e:54:3d:31:31:30:30:26:56:65:72:73:69:6f:6e:4e:54:36:34:3d:31:31:30:30\" HTTP/1.1 200 OK\nDate: Fri\n 09 May 2025 18:56:49 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive\nVary: Accept-Encoding\nServer: BunnyCDN-NY1-885\nCDN-PullZone: 3740251\nCDN-Uid: 14521c7b-4150-4d90-9a3d-a71fa50f929d\nCDN-RequestCountryCode: US\nCache-Control: public\n max-age=0\nCDN-ProxyVer: 1.27\nCDN-RequestPullSuccess: True\nCDN-RequestPullCode: 200\nCDN-CachedAt: 05/09/2025 18:56:49\nCDN-EdgeStorageId: 885\nCDN-RequestId: d51debd1141d84220e90269ac32707b7\nCDN-RequestTime: 1 with response body ==>3330.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 138.199.40.58 on port 443 is sent without HTTP header\n TCP traffic to 51.158.149.82 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00010656\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}\n \"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"17\"}\n \"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"16\"}\n \"taskcoach.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00010656.00000000.159048.02770000.00000004.mdmp, 00000000-00010656.00000001.160968.02770000.00000004.mdmp, 00000000-00010656.00000002.162890.02770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"taskcoach.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\TaskCoach\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: AdvancedInstaller\n Python-urllib/2.7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: AdvancedInstaller","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":132,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"681e4fa1ea64b354430ae0e7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["EU","FRA"],"submit_name":"setup.msi","analysis_start_time":"2025-05-09T18:55:40+00:00","indicators_count":{"informative":194,"suspicious":33,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"138.199.40.58","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"address":"51.158.149.82","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"dns_resolutions":[{"domain":"cbsnaturalway.com","address":"138.199.40.58","ttl":35,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"domain":"taskcoach.org","address":"51.158.149.82","ttl":10800,"country":"France","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"domain":"www.taskcoach.orgmessages.txt","country":"-","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"domain":"www.taskcoach.orgversion.txt","country":"-","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"http_requests":[{"host":"cbsnaturalway.com","host_ip":"138.199.40.58:443","url":"/diagnostics.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /diagnostics.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\nUser-Agent: AdvancedInstaller\nHost: cbsnaturalway.com\nContent-Length: 79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"host":"taskcoach.org","host_ip":"51.158.149.82:80","url":"/version.txt","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /version.txt HTTP/1.1\nAccept-Encoding: identity\nHost: taskcoach.org\nConnection: close\nUser-Agent: Python-urllib/2.7","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"host":"taskcoach.org","host_ip":"51.158.149.82:80","url":"/messages.txt","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /messages.txt HTTP/1.1\nAccept-Encoding: identity\nHost: taskcoach.org\nConnection: close\nUser-Agent: Python-urllib/2.7","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}],"processes":[{"pid":10544,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\setup.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00010544","icon":"$5a"},{"pid":5764,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00005764","icon":"$5b"},{"pid":8332,"ppid":5764,"name":"MsiExec.exe","command_line":"-Embedding 8F6CC9054D4F52CD553E6739F38D882C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00005764","uid":"00000000-00008332"},{"pid":10656,"ppid":5764,"name":"taskcoach.exe","command_line":"","sha256":"73d63120ba95d817aec762bb18ee93d64c880c2a275bcdab4467762b39aadbc4","normalized_path":"%APPDATA%\\Koqlpo Cynav Tool\\taskcoach.exe","parent_uid":"00000000-00005764","uid":"00000000-00010656"},{"pid":9060,"ppid":5764,"name":"tpm2emu.exe","command_line":"0","sha256":"eb10cb38b7b8a49a4f74e36e71bca2db30012ee1e9c159e8188afc817fbf50b5","normalized_path":"%APPDATA%\\Koqlpo Cynav Tool\\tpm2emu.exe","parent_uid":"00000000-00005764","uid":"00000000-00009060"}],"all_imported_dlls":["mswsock.dll","ole32.dll","msi.dll","pythoncom27.dll","sechost.dll","wkscli.dll","fusion.dll","python27.dll","userenv.dll","samcli.dll","wsock32.dll","pnrpnsp.dll","ucrtbase.dll","cryptsp.dll","sxs.dll","bcryptprimitives.dll","propsys.dll","vcruntime140_1_clr0400.dll","WININET.dll","TextInputFramework.dll","SHCore.dll","OnDemandConnRouteHelper.dll","wxbase28uh_net_vc.dll","secur32.dll","scrrun.dll","shlwapi.dll","twinapi.appcore.dll","wxmsw28uh_adv_vc.dll","kernel.appcore.dll","mpr.dll","Windows.UI.dll","imagehlp.dll","DataExchange.dll","msasn1.dll","CoreMessaging.dll","mscoree.dll","wow64win.dll","wxmsw28uh_html_vc.dll","comdlg32.dll","VxSSL32.dll","fltLib.dll","TextShaping.dll","windows.storage.dll","wow64base.dll","rpcrt4.dll","uxtheme.dll","WinTypes.dll","ncrypt.dll","winhttp.dll","wshbth.dll","apphelp.dll","comctl32.dll","netutils.dll","ServicingCommon.dll","srvcli.dll","logoncli.dll","pywintypes27.dll","dwmapi.dll","combase.dll","ucrtbase_clr0400.dll","wxbase28uh_vc.dll","srpapi.dll","oleaut32.dll","dnsapi.dll","normaliz.dll","user32.dll","msvcp_win.dll","wow64cpu.dll","NapiNSP.dll","nlansp_c.dll","bcrypt.dll","atlthunk.dll","CoreUIComponents.dll","winnsi.dll","wintrust.dll","kernel32.dll","wow64.dll","wow64con.dll","advapi32.dll","wxmsw28uh_core_vc.dll","KernelBase.dll","profapi.dll","IPHLPAPI.DLL","mscoreei.dll","setupapi.dll","GdiPlus.dll","ntdll.dll","win32u.dll","wininet.dll","nsi.dll","ncryptsslp.dll","msvcr90.dll","winmm.dll","psapi.dll","imm32.dll","shell32.dll","coml2.dll","clbcatq.dll","wldp.dll","pcacli.dll","Windows.UI.Immersive.dll","rasadhlp.dll","crypt32.dll","iertutil.dll","urlmon.dll","schannel.dll","gpapi.dll","gdi32.dll","cryptbase.dll","sspicli.dll","RstrtMgr.dll","sfc.dll","sfc_os.dll","winrnr.dll","wxmsw28uh_gizmos_vc.dll","msctf.dll","ntasn1.dll","ws2_32.dll","dpapi.dll","rsaenh.dll","libssl-1_1-x64.dll","msvcrt.dll","gdi32full.dll","version.dll","cabinet.dll","AcLayers.dll","netapi32.dll","clr.dll","FWPUCLNT.DLL","msvcp90.dll","msimg32.dll","vcruntime140_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dueToday.tsktmpl","sha256":"96878b68c6be18b60eb46be79d25a2ecaa5ac0cde24c43e33f0395894a25dcdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"dueTomorrow.tsktmpl","sha256":"7e142a3e86bdd3e3dc4b6a76c99b6d10691e36833ea11ae069f56f15e4978449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"rofgrw","sha256":"f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:10656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"Local\\SM0:10656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"SM0:10656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]},{"name":"TaskCoach","sources":[{"report_type":"sandbox","report_id":"681e4fa1ea64b354430ae0e7"}]}]}},"report_ids":{"sandbox_job_ids":["681e4fa1ea64b354430ae0e7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 9b59aa79432e… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9b59aa79432e…. Threat score 85/100. 0/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 9b59aa79432e… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9b59aa79432e…. Threat score 85/100. 0/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 9b59aa79432e… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9b59aa79432e…. Threat score 85/100. 0/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]