34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 58:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Suspicious:Packed.Krap.ao.qjxi Sample 9d7b4c294a35… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 9d7b4c294a35…. Malware family: Suspicious:Packed.Krap.ao.qjxi. Threat score 80/100. 1/27 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","keywords":["Malicious","Suspicious:Packed.Krap.ao.qjxi","malware analysis","sandbox report","threat intelligence","9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615"],"about":{"@type":"SoftwareApplication","name":"VeraCrypt.Setup.1.26.31.exe","applicationCategory":["peexe","executable"],"identifier":"9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Suspicious:Packed.Krap.ao.qjxi","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4b1,Found string "Wrong password provided" (Indicator: "password"; Source: "sample.bin"), Found string "Delete TPM secret" (Indicator: "secret"; Source: "sample.bin"), Found string "No password provided" (Indicator: "password"; Source: "sample.bin"), Found string "Security token password/PIN required" (Indicator: "password"; Source: "sample.bin"), Found string "New password" (Indicator: "password"; Source: "sample.bin"), Found string "Confirm password:" (Indicator: "password"; Source: "sample.bin"), Found string "TPM owner password:" (Indicator: "password"; Source: "sample.bin"), Found string "New password:" (Indicator: "password"; Source: "sample.bin"), Found string "&Display password" (Indicator: "password"; Source: "sample.bin"), Found string "Update TPM secret" (Indicator: "secret"; Source: "sample.bin"), Found string " 'Incorrect password' error message later. " (Indicator: "password"; Source: "sample.bin"), Found string "%EAuthorization failed. Wrong password, PIM or hash. Decrypt error(%x) %N" (Indicator: "password"; Source: "sample.bin"), Found string "Try first to mount with an empty password" (Indicator: "password"; Source: "sample.bin")37:T5a9,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "VeraCrypt::File::GetFileSize:999" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "VeraCrypt::File::GetFileSize:988" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetTempPathString:6430" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API "VeraCrypt::Elevator::GetFileSize:820" (Indicator: "GetFileSize"; Source: "sample.bin")38:T637,Found string ". " (Indicator: "aes"; Source: "sample.bin"), Found string "invalid WinZip AES extra field" (Indicator: "aes"; Source: "sample.bin"), Found string "Twofish" (Indicator: "twofish"; Source: "sample.bin"), Found string " AES: " (Indicator: "aes"; Source: "sample.bin"), Found string "serpent" (Indicator: "serpent"; Source: "sample.bin"), Found string ". " (Indicator: "serpent"; Source: "sample.bin"), Found string " " (Indicator: "aes"; Source: "sample.bin"), Found string " " (Indicator: "twofish"; Source: "sample.bin"), Found string "tSerpent.html" (Indicator: "serpent"; Source: "sample.bin"), Found string "Serpent" (Indicator: "serpent"; Source: "sample.bin"), Found string "Rijndael" (Indicator: "rijndael"; Source: "sample.bin"), Found string " (AES) " (Indicator: "aes"; Source: "sample.bin"), Found string "Hardware-accelerated AES:" (Indicator: "aes"; Source: "sample.bin"), Found string "twofish" (Indicator: "twofish"; Source: "sample.bin"), Found string "sAES.html" (Indicator: "aes"; Source: "sample.bin"), Found string " AES: " (Indicator: "aes"; Source: "sample.bin"), Found string "hTwofish.html" (Indicator: "twofish"; Source: "sample.bin"), Found string ": " (Indicator: "aes"; Source: "sample.bin")39:Tb64,Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "sample.bin"), Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "sample.bin"), Found reference to API "GetAce" (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "ImpersonateSelf" (Indicator: "ImpersonateSelf"; Source: "sample.bin"), Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API "PrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "sample.bin"), Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; Source: "sample.bin"), Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin")3a:T6981,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextVolumeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process2"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "sample.bin"), Found reference to API (Indicator: "SHDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "MapDialogRect"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentObject"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "CreateServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "AddAccessAllowedAceEx"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiOpenClassRegKey"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetShellWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualLock"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RegGetValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "MapGenericMask"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "ImpersonateSelf"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHCreateDirectoryExW"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstVolumeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidAcl"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "FindVolumeClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFirmwareEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "SetMapMode"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryDosDeviceW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "EnumChildWindows"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "PrivilegeCheck"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "IsWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFirmwareEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteService"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringOrdinal"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteTreeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "LCIDToLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")3b:T98f,"Software\VeraCrypt" in Source: sample.bin, "Software\Classes\VeraCryptVolume\DefaultIcon" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: sample.bin, "Software\Microsoft\Windows" in Source: sample.bin, "NSOFTWARE\VeraCrypt_MSI" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\MountMgr" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hc" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Power" in Source: sample.bin, "Software\Classes\VeraCryptVolume\Shell\open\command" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VeraCryptSystemFavorites" in Source: sample.bin, "Software\VeraCrypt_MSI" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\veracrypt" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VeraCryptSystemFavorites" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\CrashControl" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\Power" in Source: sample.bin, "Software\Classes\VeraCryptVolume\Shell\open" in Source: sample.bin, "Software\VeraCrypt\Diagnostics\EfiBootLoader" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\veracrypt\InstallationPath" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Memory Management" in Source: sample.bin, "Software\Classes\VeraCryptVolume" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: sample.bin, "Software\Classes\.hc" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\VeraCryptSystemFavorites" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\VeraCrypt" in Source: sample.bin, "Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: sample.bin, "Software\Classes\VeraCryptVolume\Shell" in Source: sample.bin, "Software\VeraCrypt\Diagnostics" in Source: sample.bin, "Software\Microsoft\Windows\Curren" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: sample.bin3c:Tc1f,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "BCryptDeriveKey"; Source: "sample.bin"), Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "BCryptDeriveKeyPBKDF2"; Source: "sample.bin"), Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "CryptDeriveKey"; Source: "sample.bin"), Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "sample.bin"), Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin")3d:T706,Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API "BCryptDeriveKeyPBKDF2" (Indicator: "CryptDeriveKey"; Source: "sample.bin"), Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API "BCryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin")3e:T54d,"VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VERACRYPT.SETUP.1.26.31.EXE") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER")3f:T4e3,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform CAST-128/CAST-256 encryption Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption40:T58d,"VeraCrypt.Setup.1.26.31.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "VeraCrypt.Setup.1.26.31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")41:T842,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005460.00000000.180164.0426F000.00000004.mdmp 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.04293000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005460.00000000.180164.0426F000.00000004.mdmp 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.04293000.00000004.mdmp "ers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "ers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.041F0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000001.182085.07270000.00000004.mdmp 00000000-00005460.00000002.182118.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.07270000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000001.182085.07270000.00000004.mdmp 00000000-00005460.00000002.182118.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.07270000.00000004.mdmp "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp 00000000-00005460.00000002.182118.04293000.00000004.mdmp42:T51b,Antivirus vendors marked dropped file "VeraCryptExpander.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "VeraCrypt.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "VeraCrypt Format.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "VeraCrypt User Guide.zh-cn.chm" as clean (type is "MS Windows HtmlHelp Data"), Antivirus vendors marked dropped file "VeraCrypt User Guide.chm" as clean (type is "MS Windows HtmlHelp Data"), Antivirus vendors marked dropped file "VeraCrypt User Guide.ru.chm" as clean (type is "MS Windows HtmlHelp Data"), Antivirus vendors marked dropped file "veracrypt.cat" as clean (type is "Unknown"), Antivirus vendors marked dropped file "veracrypt.inf" as clean (type is "Unknown"), Antivirus vendors marked dropped file "liberapay_donate.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "liberapay.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "veracrypt.sys" as clean (type is "PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections")43:T1f64,"\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00005460.00000000.180164.03EE4000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\Elevation" in Source: 00000000-00005460.00000000.180164.03EE4000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00005460.00000000.180164.03EE4000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00005460.00000000.180164.0426F000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00005460.00000001.182085.03EE4000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\Elevation" in Source: 00000000-00005460.00000001.182085.03EE4000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00005460.00000001.182085.03EE4000.00000004.mdmp "Registry\Machine\Software\Classes\VeraCrypt\CurVer" in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{56327DDA-F1A7-4E13-B128-520D129BDEF6}" in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\Interface\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\ProxyStubClsid32" in Source: 00000000-00005460.00000001.182085.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\VeraCrypt" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume\DefaultIcon" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume\Shell\open\command" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "Adding registry entry Software\Classes\.hc" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "Adding registry entry Software\Microsoft\Windows\CurrentVersion\Uninstall\VeraCrypt" in Source: 00000000-00005460.00000001.182085.07270000.00000004.mdmp "SOFTWARE\VeraCrypt_MSI" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\veracrypt" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\VeraCrypt" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\VeraCryptVolume" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\VeraCryptVolume\DefaultIcon" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\VeraCryptVolume\Shell\open\command" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\.hc" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\VeraCrypt" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\VeraCrypt\Diagnostics" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\VeraCrypt\Diagnostics\EfiBootLoader" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\VeraCryptVolume\Shell\open" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Classes\VeraCryptVolume\Shell" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hc" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Power" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\veracrypt\InstallationPath" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\CrashControl" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VeraCryptSystemFavorites" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VeraCryptSystemFavorites" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\VeraCryptSystemFavorites" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\VeraCrypt_MSI" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\MountMgr" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "System\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Power" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows\Curren" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Software\Microsoft\Windows" in Source: 00000000-00005460.00000002.182118.00488000.00000002.mdmp "Registry\Machine\Software\Classes\VeraCrypt\CurVer" in Source: 00000000-00005460.00000002.182118.041F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00005460.00000002.182118.04293000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00005460.00000002.182118.04293000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{56327DDA-F1A7-4E13-B128-520D129BDEF6}" in Source: 00000000-00005460.00000002.182118.04293000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\Interface\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\ProxyStubClsid32" in Source: 00000000-00005460.00000002.182118.04293000.00000004.mdmp "Registry\Machine\Software\Classes\VeraCrypt" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume\DefaultIcon" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp "Adding registry entry Software\Classes\VeraCryptVolume\Shell\open\command" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp "Adding registry entry Software\Classes\.hc" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp "Adding registry entry Software\Microsoft\Windows\CurrentVersion\Uninstall\VeraCrypt" in Source: 00000000-00005460.00000002.182118.07270000.00000004.mdmp44:T830a,"VeraCryptExpander.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCryptExpander.exe]- [targetUID: 00000000-00005460] "VeraCrypt.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe]- [targetUID: 00000000-00005460] "VeraCrypt Setup.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 7 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe]- [targetUID: 00000000-00005460] "VeraCrypt Format.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe]- [targetUID: 00000000-00005460] "VeraCrypt User Guide.zh-cn.chm" has type "MS Windows HtmlHelp Data"- Location: [%PROGRAMFILES%\VeraCrypt\docs\VeraCrypt User Guide.zh-cn.chm]- [targetUID: 00000000-00005460] "VeraCrypt User Guide.chm" has type "MS Windows HtmlHelp Data"- Location: [%PROGRAMFILES%\VeraCrypt\docs\VeraCrypt User Guide.chm]- [targetUID: 00000000-00005460] "VeraCrypt User Guide.ru.chm" has type "MS Windows HtmlHelp Data"- Location: [%PROGRAMFILES%\VeraCrypt\docs\VeraCrypt User Guide.ru.chm]- [targetUID: 00000000-00005460] "veracrypt.cat" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\veracrypt.cat]- [targetUID: 00000000-00005460] "veracrypt.inf" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\veracrypt.inf]- [targetUID: 00000000-00005460] "liberapay_donate.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\liberapay_donate.svg]- [targetUID: 00000000-00005460] "liberapay.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\liberapay.svg]- [targetUID: 00000000-00005460] "Language.my.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.my.xml]- [targetUID: 00000000-00005460] "Language.ka.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ka.xml]- [targetUID: 00000000-00005460] "veracrypt.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections"- Location: [%PROGRAMFILES%\VeraCrypt\veracrypt.sys]- [targetUID: 00000000-00005460] "Language.th.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.th.xml]- [targetUID: 00000000-00005460] "Language.el.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.el.xml]- [targetUID: 00000000-00005460] "Language.bg.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.bg.xml]- [targetUID: 00000000-00005460] "Language.be.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.be.xml]- [targetUID: 00000000-00005460] "Language.uz.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.uz.xml]- [targetUID: 00000000-00005460] "Language.uk.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.uk.xml]- [targetUID: 00000000-00005460] "Language.ru.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ru.xml]- [targetUID: 00000000-00005460] "Language.fa.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.fa.xml]- [targetUID: 00000000-00005460] "Language.ja.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ja.xml]- [targetUID: 00000000-00005460] "Language.ar.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ar.xml]- [targetUID: 00000000-00005460] "Language.vi.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.vi.xml]- [targetUID: 00000000-00005460] "Language.he.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.he.xml]- [targetUID: 00000000-00005460] "Language.co.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.co.xml]- [targetUID: 00000000-00005460] "Language.fr.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.fr.xml]- [targetUID: 00000000-00005460] "Language.de.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.de.xml]- [targetUID: 00000000-00005460] "Language.hu.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.hu.xml]- [targetUID: 00000000-00005460] "Language.ko.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ko.xml]- [targetUID: 00000000-00005460] "Language.nl.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.nl.xml]- [targetUID: 00000000-00005460] "Language.pt-br.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.pt-br.xml]- [targetUID: 00000000-00005460] "Language.tr.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.tr.xml]- [targetUID: 00000000-00005460] "Language.ro.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ro.xml]- [targetUID: 00000000-00005460] "Language.sk.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.sk.xml]- [targetUID: 00000000-00005460] "Language.es.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.es.xml]- [targetUID: 00000000-00005460] "Language.it.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.it.xml]- [targetUID: 00000000-00005460] "Language.lv.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.lv.xml]- [targetUID: 00000000-00005460] "Language.fi.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.fi.xml]- [targetUID: 00000000-00005460] "Language.cs.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.cs.xml]- [targetUID: 00000000-00005460] "Language.pl.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.pl.xml]- [targetUID: 00000000-00005460] "Language.sv.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.sv.xml]- [targetUID: 00000000-00005460] "Language.eu.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.eu.xml]- [targetUID: 00000000-00005460] "Language.ca.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ca.xml]- [targetUID: 00000000-00005460] "Language.da.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.da.xml]- [targetUID: 00000000-00005460] "Language.nn.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.nn.xml]- [targetUID: 00000000-00005460] "Language.sl.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.sl.xml]- [targetUID: 00000000-00005460] "Language.nb.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.nb.xml]- [targetUID: 00000000-00005460] "Language.id.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.id.xml]- [targetUID: 00000000-00005460] "Language.et.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.et.xml]- [targetUID: 00000000-00005460] "Language.zh-hk.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.zh-hk.xml]- [targetUID: 00000000-00005460] "Language.zh-tw.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.zh-tw.xml]- [targetUID: 00000000-00005460] "Language.zh-cn.xml" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.zh-cn.xml]- [targetUID: 00000000-00005460] "Home_VeraCrypt_Creating_Volume.png" has type "PNG image data 704 x 505 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Creating_Volume.png]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_002.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_007.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Home_VeraCrypt_languages_selection.png" has type "PNG image data 582 x 504 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_languages_selection.png]- [targetUID: 00000000-00005460] "FAQ.html" has type "HTML document Unicode text UTF-8 text with very long lines (960)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\FAQ.html]- [targetUID: 00000000-00005460] "Home_VeraCrypt_NonSysEncryption.png" has type "PNG image data 616 x 410 8-bit/color RGB non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_NonSysEncryption.png]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_020.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_022.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_017.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_004.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_001.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_015.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_021.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_014.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Home_VeraCrypt_Encrypting_Partition.png" has type "PNG image data 606 x 368 8-bit/color RGB non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Encrypting_Partition.png]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_010.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_005.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 progressive precision 8 857x743 components 3"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_016.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_011.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_003.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_008.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "License.txt" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\License.txt]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_009.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Encryption Algorithms.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Encryption Algorithms.html]- [targetUID: 00000000-00005460] "CompilingGuidelineWin.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\CompilingGuidelineWin.html]- [targetUID: 00000000-00005460] "Downloads.html" has type "HTML document Unicode text UTF-8 text with very long lines (386) with CRLF LF line terminators"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Downloads.html]- [targetUID: 00000000-00005460] "Keyfiles in VeraCrypt.html" has type "HTML document Unicode text UTF-8 text with very long lines (435)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Keyfiles in VeraCrypt.html]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_BitcoinCash.png" has type "PNG image data 200 x 200 8-bit/color RGB interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_BitcoinCash.png]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_019.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Downloads_1.25.9.html" has type "HTML document Unicode text UTF-8 text with very long lines (339) with CRLF line terminators"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Downloads_1.25.9.html]- [targetUID: 00000000-00005460] "EFISecureBoot.html" has type "HTML document Unicode text UTF-8 text with very long lines (656)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\EFISecureBoot.html]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_018.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_013.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "Command Line Usage for Windows.html" has type "HTML document Unicode text UTF-8 text with very long lines (479)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Command Line Usage for Windows.html]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_034.png" has type "Unknown"- [targetUID: 00000000-00005460] "Home_VeraCrypt_menu_Default_Mount_Parameters.png" has type "PNG image data 347 x 459 8-bit colormap interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_menu_Default_Mount_Parameters.png]- [targetUID: 00000000-00005460] "Home.html" has type "HTML document Unicode text UTF-8 text with very long lines (426) with CRLF LF line terminators"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home.html]- [targetUID: 00000000-00005460] "Command Line Usage for Unix.html" has type "HTML document Unicode text UTF-8 text with very long lines (512)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Command Line Usage for Unix.html]- [targetUID: 00000000-00005460] "Default Mount Parameters_VeraCrypt_password_using_default_parameters.png" has type "PNG image data 829 x 341 8-bit colormap interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Default Mount Parameters_VeraCrypt_password_using_default_parameters.png]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_024.gif" has type "Unknown"- [targetUID: 00000000-00005460] "Beginner_s Tutorial.html" has type "Unknown"- [targetUID: 00000000-00005460] "Issues and Limitations.html" has type "HTML document Unicode text UTF-8 text with very long lines (708)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Issues and Limitations.html]- [targetUID: 00000000-00005460] "Keyfiles in VeraCrypt_Image_040.gif" has type "GIF image data version 89a 812 x 287"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Keyfiles in VeraCrypt_Image_040.gif]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_023.gif" has type "Unknown"- [targetUID: 00000000-00005460] "NOTICE" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\NOTICE]- [targetUID: 00000000-00005460] "LICENSE" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\LICENSE]- [targetUID: 00000000-00005460] "Documentation.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Documentation.html]- [targetUID: 00000000-00005460] "Argon2id.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Argon2id.html]- [targetUID: 00000000-00005460] "Beginner_s Tutorial_Image_012.jpg" has type "Unknown"- [targetUID: 00000000-00005460] "CompilingGuidelineLinux.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\CompilingGuidelineLinux.html]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_Bitcoin.png" has type "PNG image data 250 x 250 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Bitcoin.png]- [targetUID: 00000000-00005460] "Creating New Volumes.html" has type "HTML document Unicode text UTF-8 text with very long lines (330)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Creating New Volumes.html]- [targetUID: 00000000-00005460] "Header Key Derivation.html" has type "HTML document Unicode text UTF-8 text with very long lines (320)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Header Key Derivation.html]- [targetUID: 00000000-00005460] "Hidden Volume.html" has type "HTML document Unicode text UTF-8 text with very long lines (503)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hidden Volume.html]- [targetUID: 00000000-00005460] "Cascades.html" has type "HTML document Unicode text UTF-8 text with very long lines (351)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Cascades.html]- [targetUID: 00000000-00005460] "Donation_VC_BTC_Sigwit.png" has type "PNG image data 200 x 200 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VC_BTC_Sigwit.png]- [targetUID: 00000000-00005460] "Donation.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation.html]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_Ethereum.png" has type "PNG image data 200 x 200 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Ethereum.png]- [targetUID: 00000000-00005460] "How to Back Up Securely.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\How to Back Up Securely.html]- [targetUID: 00000000-00005460] "Keyfiles.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Keyfiles.html]- [targetUID: 00000000-00005460] "Favorite Volumes.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Favorite Volumes.html]- [targetUID: 00000000-00005460] "Home_VeraCrypt_Default_Mount_Parameters.png" has type "PNG image data 422 x 232 8-bit colormap interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Default_Mount_Parameters.png]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_Monero.png" has type "PNG image data 200 x 200 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Monero.png]- [targetUID: 00000000-00005460] "Encryption Scheme.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Encryption Scheme.html]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_Bitcoin_small.png" has type "PNG image data 200 x 200 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Bitcoin_small.png]- [targetUID: 00000000-00005460] "Digital Signatures.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Digital Signatures.html]- [targetUID: 00000000-00005460] "Incompatibilities.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Incompatibilities.html]- [targetUID: 00000000-00005460] "Donation_VeraCrypt_Litecoin.png" has type "PNG image data 200 x 200 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Litecoin.png]- [targetUID: 00000000-00005460] "Hardware Acceleration.html" has type "HTML document Unicode text UTF-8 text with very long lines (715)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hardware Acceleration.html]- [targetUID: 00000000-00005460] "Data Leaks.html" has type "HTML document Unicode text UTF-8 text with very long lines (721)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Data Leaks.html]- [targetUID: 00000000-00005460] "Hibernation File.html" has type "HTML document Unicode text UTF-8 text with very long lines (401)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hibernation File.html]- [targetUID: 00000000-00005460] "Conversion_Guide_VeraCrypt_1.26_and_Later.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Conversion_Guide_VeraCrypt_1.26_and_Later.html]- [targetUID: 00000000-00005460] "Home_Windows_32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Windows_32x32.png]- [targetUID: 00000000-00005460] "Hash Algorithms.html" has type "HTML document Unicode text UTF-8 text with very long lines (383)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hash Algorithms.html]- [targetUID: 00000000-00005460] "Introduction.html" has type "HTML document Unicode text UTF-8 text with very long lines (400)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Introduction.html]- [targetUID: 00000000-00005460] "Home_Finder_32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Finder_32x32.png]- [targetUID: 00000000-00005460] "Home_Linux_32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Linux_32x32.png]- [targetUID: 00000000-00005460] "index.html" has type "HTML document Unicode text UTF-8 text with very long lines (421) with CRLF line terminators"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\index.html]- [targetUID: 00000000-00005460] "Avoid Third-Party File Extensions.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Avoid Third-Party File Extensions.html]- [targetUID: 00000000-00005460] "language_selection.js" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\language_selection.js]- [targetUID: 00000000-00005460] "BC_Logo_30x30.png" has type "PNG image data 30 x 30 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BC_Logo_30x30.png]- [targetUID: 00000000-00005460] "Code.html" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Code.html]- [targetUID: 00000000-00005460] "Contributed Resources.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Contributed Resources.html]- [targetUID: 00000000-00005460] "Acknowledgements.html" has type "HTML document Unicode text UTF-8 text with very long lines (311)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Acknowledgements.html]- [targetUID: 00000000-00005460] "Changing Passwords and Keyfiles.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Changing Passwords and Keyfiles.html]- [targetUID: 00000000-00005460] "Choosing Passwords and Keyfiles.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Choosing Passwords and Keyfiles.html]- [targetUID: 00000000-00005460] "Disclaimers.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Disclaimers.html]- [targetUID: 00000000-00005460] "AES.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\AES.html]- [targetUID: 00000000-00005460] "BLAKE2s-256.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BLAKE2s-256.html]- [targetUID: 00000000-00005460] "Key Derivation Algorithms.html" has type "HTML document Unicode text UTF-8 text with very long lines (411)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Key Derivation Algorithms.html]- [targetUID: 00000000-00005460] "Default Mount Parameters.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Default Mount Parameters.html]- [targetUID: 00000000-00005460] "Converting TrueCrypt volumes and partitions.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Converting TrueCrypt volumes and partitions.html]- [targetUID: 00000000-00005460] "Defragmenting.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Defragmenting.html]- [targetUID: 00000000-00005460] "Legal Information.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Legal Information.html]- [targetUID: 00000000-00005460] "EMV Smart Cards.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\EMV Smart Cards.html]- [targetUID: 00000000-00005460] "freebsd-32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\freebsd-32x32.png]- [targetUID: 00000000-00005460] "Contact.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Contact.html]- [targetUID: 00000000-00005460] "Donation_donate_PLN.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_PLN.gif]- [targetUID: 00000000-00005460] "Language Packs.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Language Packs.html]- [targetUID: 00000000-00005460] "BLAKE2b-512.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BLAKE2b-512.html]- [targetUID: 00000000-00005460] "Journaling File Systems.html" has type "HTML document Unicode text UTF-8 text with very long lines (369)"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Journaling File Systems.html]- [targetUID: 00000000-00005460] "Hidden Operating System.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hidden Operating System.html]- [targetUID: 00000000-00005460] "Additional Security Requirements and Precautions.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Additional Security Requirements and Precautions.html]- [targetUID: 00000000-00005460] "Camellia.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Camellia.html]- [targetUID: 00000000-00005460] "Authenticity and Integrity.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Authenticity and Integrity.html]- [targetUID: 00000000-00005460] "chm_32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\chm_32x32.png]- [targetUID: 00000000-00005460] "Kuznyechik.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Kuznyechik.html]- [targetUID: 00000000-00005460] "Home_canary.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_canary.png]- [targetUID: 00000000-00005460] "CompilingGuidelines.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\CompilingGuidelines.html]- [targetUID: 00000000-00005460] "Android _ iOS Support.html" has type "Unknown"- [targetUID: 00000000-00005460] "flattr-badge-large.png" has type "PNG image data 93 x 20 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flattr-badge-large.png]- [targetUID: 00000000-00005460] "Authors.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Authors.html]- [targetUID: 00000000-00005460] "Home_utilities-file-archiver-3.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_utilities-file-archiver-3.png]- [targetUID: 00000000-00005460] "BCH_Logo_48x30.png" has type "PNG image data 48 x 30 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BCH_Logo_48x30.png]- [targetUID: 00000000-00005460] "flag-gb.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-gb.png]- [targetUID: 00000000-00005460] "Home_RaspberryPi_32x32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_RaspberryPi_32x32.png]- [targetUID: 00000000-00005460] "Command Line Usage.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Command Line Usage.html]- [targetUID: 00000000-00005460] "bank_30x30.png" has type "PNG image data 30 x 30 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\bank_30x30.png]- [targetUID: 00000000-00005460] "BCH_Logo_30x30.png" has type "PNG image data 30 x 30 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BCH_Logo_30x30.png]- [targetUID: 00000000-00005460] "Donation_donate_Dollars.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_Dollars.gif]- [targetUID: 00000000-00005460] "Hot Keys.html" has type "HTML document Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Hot Keys.html]- [targetUID: 00000000-00005460] "Donation_donate_GBP.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_GBP.gif]- [targetUID: 00000000-00005460] "Donation_donate_YEN.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_YEN.gif]- [targetUID: 00000000-00005460] "LTC_Logo_30x30.png" has type "PNG image data 30 x 30 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\LTC_Logo_30x30.png]- [targetUID: 00000000-00005460] "Donation_donate_Euros.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_Euros.gif]- [targetUID: 00000000-00005460] "Donation_donate_CHF.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_CHF.gif]- [targetUID: 00000000-00005460] "flag-eu.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-eu.png]- [targetUID: 00000000-00005460] "Donation_donate.gif" has type "GIF image data version 89a 92 x 26"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate.gif]- [targetUID: 00000000-00005460] "flag-au.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-au.png]- [targetUID: 00000000-00005460] "flag-nz.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-nz.png]- [targetUID: 00000000-00005460] "Home_reddit.png" has type "PNG image data 94 x 28 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_reddit.png]- [targetUID: 00000000-00005460] "flag-us.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-us.png]- [targetUID: 00000000-00005460] "flag-au-small.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-au-small.png]- [targetUID: 00000000-00005460] "flag-gb-small.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-gb-small.png]- [targetUID: 00000000-00005460] "flag-us-small.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-us-small.png]- [targetUID: 00000000-00005460] "flag-eu-small.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-eu-small.png]- [targetUID: 00000000-00005460] "Ethereum_Logo_19x30.png" has type "PNG image data 19 x 30 8-bit/color RGB non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Ethereum_Logo_19x30.png]- [targetUID: 00000000-00005460] "gf2_mul.gif" has type "GIF image data version 89a 10 x 10"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\gf2_mul.gif]- [targetUID: 00000000-00005460] "Home_facebook_veracrypt.png" has type "PNG image data 61 x 28 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_facebook_veracrypt.png]- [targetUID: 00000000-00005460] "flag-nz-small.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-nz-small.png]- [targetUID: 00000000-00005460] "Home_tibitDonateButton.png" has type "PNG image data 120 x 40 4-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_tibitDonateButton.png]- [targetUID: 00000000-00005460] "donation.js" has type "Unknown"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\donation.js]- [targetUID: 00000000-00005460] "en-flag.png" has type "PNG image data 20 x 11 4-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\en-flag.png]- [targetUID: 00000000-00005460] "arrow_right.gif" has type "GIF image data version 89a 4 x 7"- Location: [%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\arrow_right.gif]- [targetUID: 00000000-00005460] "veracrypt.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections"- Location: [%WINDIR%\System32\drivers\veracrypt.sys]- [targetUID: 00000000-00005460]45:Ta13,"Language.my.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.my.xml] "Language.ka.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ka.xml] "Language.th.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.th.xml] "Language.el.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.el.xml] "Language.bg.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.bg.xml] "Language.be.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.be.xml] "Language.uz.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.uz.xml] "Language.uk.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.uk.xml] "Language.ru.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ru.xml] "Language.fa.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.fa.xml] "Language.ja.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ja.xml] "Language.ar.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ar.xml] "Language.vi.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.vi.xml] "Language.he.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.he.xml] "Language.co.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.co.xml] "Language.fr.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.fr.xml] "Language.de.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.de.xml] "Language.hu.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.hu.xml] "Language.ko.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ko.xml] "Language.nl.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.nl.xml] "Language.pt-br.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.pt-br.xml] "Language.tr.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.tr.xml] "Language.ro.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.ro.xml] "Language.sk.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.sk.xml] "Language.es.xml" has type "Unknown" - Location: [%PROGRAMFILES%\VeraCrypt\Languages\Language.es.xml]46:T5e4,"VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}\"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")47:Td7a,"VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "VERACRYPT.SETUP.1.26.31.EXE"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "VeraCrypt.Setup.1.26.31.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "")48:T40f,"VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\System32\wow64log.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_a865dda286726b5c\comctl32.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_a865dda286726b5c\COMCTL32.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\SysWOW64\riched20.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\WINDOWS\SysWOW64\Riched20.dll" "VeraCrypt.Setup.1.26.31.exe" trying to touch file "C:\Windows\SysWOW64\usp10.dll"49:T6d5,"VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\License.txt" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\LICENSE" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\NOTICE" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\VeraCrypt.exe" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\VeraCryptExpander.exe" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\VeraCrypt Format.exe" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\veracrypt.inf" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\veracrypt.cat" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\veracrypt.sys" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\VeraCrypt Setup.exe" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.ar.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.be.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.bg.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.ca.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.co.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.cs.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.da.xml" "VeraCrypt.Setup.1.26.31.exe" touched file "C:\Program Files\VeraCrypt\Languages\Language.de.xml"4a:T489,"VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\VeraCrypt Setup.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\VeraCrypt.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt-x86.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCryptExpander-x86.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt Format-x86.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt-x64.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCryptExpander-x64.exe" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt Format-x64.exe"4b:T7cb,"VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Configuration.xml" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Languages" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Program Files\VeraCrypt" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "VeraCrypt" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\Windows\SysWOW64\VeraCrypt System Favorite Volumes.xml" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\docs\html\en\ru" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt-x86.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCryptExpander-x86.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt Format-x86.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt-x64.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCryptExpander-x64.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\VeraCrypt Format-x64.exe_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\veracrypt-x64.sys_old" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\veracrypt-x64.sys" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "VeraCrypt.Setup.1.26.31.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt"4c:T5da8,Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005460.00000000.180164.045E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005460.00000000.180164.045E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005460.00000000.180164.045E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/reposito'x" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005460.00000000.180164.07270000.00000004.mdmp") Found URL "http://www.truecrypt.org/>m4" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://www.truecrypt.org/>z4" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0g" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-greater" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcnew" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm9ckx" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e00'44http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\tr0" - Source: "00000000-00005460.00000001.182085.045E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhtt0" - Source: "00000000-00005460.00000001.182085.045E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttruste1k5itampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005460.00000001.182085.045E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/reposito'x" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://sourceforge.net/p/veracrypt/discussion/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://unit193.net/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://launchpad.net/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://www.codeplex.com/site/users/view/haggster" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://sourceforge.net/projects/veracrypt/files/contributions/arm%20linux/veracrypt-1.0f-1-setup-arm.tar.bz2/download" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://schneckchen.in/veracrypt-anleitung-zum-daten-verschluesseln/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://schneckchen.in/veracrypt-anleitung-zum-daten-verschluesseln/:

german" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://howto.wared.fr/raspberry-pi-arch-linux-arm-installation-veracrypt/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://howto.wared.fr/raspberry-pi-arch-linux-arm-installation-veracrypt/:
- french" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://howto.wared.fr/author/wared/" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://sourceforge.net/projects/veracrypt/files/contributions/clonezilla_using_veracrypt_ver_1.1.doc/download" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://www.codeplex.com/site/users/view/pjc123" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://bohdan-danishevsky.blogspot.fr/2016/11/raspberry-pi-raspbian-installing.html" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://bohdan-danishevsky.blogspot.fr/2016/11/raspberry-pi-raspbian-installing.html
  - tutorial" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "http://sourceforge.net/projects/veracrypt/files/contributions/vcsteg2.py/download" - Source: "00000000-00005460.00000001.182085.07270000.00000004.mdmp") Found URL "https://amcrypto.jpurlinfoaboutsoftware\classes\veracryptvolumeveracrypt" - Source: "00000000-00005460.00000002.182118.00488000.00000002.mdmp") Found URL "https://veracrypt.jp[internetshortcut]url=%s\uninstall" - Source: "00000000-00005460.00000002.182118.00488000.00000002.mdmp") Found URL "http://www.truecrypt.org/" - Source: "00000000-00005460.00000002.182118.00488000.00000002.mdmp") Found URL "https://veracrypt.jp/%s/documentation.htmlkeyfiles.htmlavoid%20third-party%20file%20extensions.htmlcreating%20new%20volumes.htmlsystem%20encryption.htmlveracrypt%20hidden%20operating%20system.htmlhidden%20volume.htmlaes.htmlserpent.htmltwofish.htmlkuznyechik.htmlcamellia.htmlcascades.htmlhash%20algorithms.htmlhttps://cdburnerxp.se/en/homesystem%20favorite%20volumes.htmlfavorite%20volumes.htmlprotection%20of%20hidden%20volumes.htmlfaq.htmldownloads.htmlnews.htmlcontact.htmlpersonal%20iterations%20multiplier%20%28pim%29.htmlveracrypt%20memory%20protection.htmlhttps://veracrypt.jp/%s/%sdocs\html\file:///%sdocs/html/en/%sfile:///%sdocs/html/%s/%ssystem\currentcontrolset\services\mountmgrnoautomountpagingfilessystem\currentcontrolset\control\session" - Source: "00000000-00005460.00000002.182118.00488000.00000002.mdmp") Found URL "http://www.truecrypt.org/>m4" - Source: "00000000-00005460.00000002.182118.04274000.00000004.mdmp") Found URL "http://www.truecrypt.org/>z4" - Source: "00000000-00005460.00000002.182118.04274000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0g" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-greater" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcnew" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm9ckx" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005460.00000002.182118.04293000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e00'44http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\tr0" - Source: "00000000-00005460.00000002.182118.045E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhtt0" - Source: "00000000-00005460.00000002.182118.045E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttruste1k5itampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005460.00000002.182118.045E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/reposito'x" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005460.00000002.182118.07270000.00000004.mdmp")4d:T1542,Found string "Rescue target disk not identified yet: %r" (Indicator: "rescue"; File: "VeraCrypt.Setup.1.26.31.exe") Found string "RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04274000.00000004.mdmp") Found string "RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04274000.00000004.mdmp") Found string "RESCUE_DISK_INFO" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_BURN_INFO" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_BURN_NO_CHECK_WARN" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_BURN_INFO_NO_CHECK" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_2" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_CREATED_TITLE" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_DISK_VERIFIED_TITLE" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_3" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_4" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_5" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_6" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_VERIFIED_INFO" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_RECORDING_TITLE" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_1" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_7" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_8" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_HELP_PORTION_9" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_EFI_INFO" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04283000.00000004.mdmp") Found string "RESCUE_DISK_EFI_EXTRACT_INFO" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04283000.00000004.mdmp") Found string "RESCUE_DISK_EFI_CHECK_FAILED" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04283000.00000004.mdmp") Found string "RESCUE_DISK_NON_WIZARD_CREATION_SELECT_PATH" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_ISO_IMAGE_CHECK_PASSED" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_NON_WIZARD_CREATION_WIN_ISOBURN" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp") Found string "RESCUE_DISK_NON_WIZARD_CHECK_PASSED" (Indicator: "rescue"; Source: "00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp")4e:T5dd4,"VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "5D040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D7001C020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B0104931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B012945010129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D2003555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C97603664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503E600060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E74036363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F93029283510192C41401930547019369C70096390B01994664019AC657019C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100") "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME"; Key: "(DEFAULT)"; Value: "VeraCrypt Volume"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME"; Key: "APPUSERMODELID"; Value: "AMCrypto.VeraCrypt"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe 1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe" /v "%1""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.HC"; Key: "(DEFAULT)"; Value: "VeraCryptVolume"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "GLOBALASSOCCHANGEDCOUNTER"; Value: "0100000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "UNINSTALLSTRING"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe" /u"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "MODIFYPATH"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe" /c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "DISPLAYICON"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "DISPLAYVERSION"; Value: "1.26.31"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "DISPLAYNAME"; Value: "VeraCrypt"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "PUBLISHER"; Value: "AM Crypto"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "URLINFOABOUT"; Value: "https://amcrypto.jp"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPT.1"; Key: "(DEFAULT)"; Value: "VeraCrypt class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPT.1\CLSID"; Key: "(DEFAULT)"; Value: "{FE8B3B95-C80C-41f7-830F-FBA271C26F7E}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPT"; Key: "(DEFAULT)"; Value: "VeraCrypt class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPT\CLSID"; Key: "(DEFAULT)"; Value: "{FE8B3B95-C80C-41f7-830F-FBA271C26F7E}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPT\CURVER"; Key: "(DEFAULT)"; Value: "VeraCrypt.1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "(DEFAULT)"; Value: "VeraCrypt class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\PROGID"; Key: "(DEFAULT)"; Value: "VeraCrypt.1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "VeraCrypt"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\TYPELIB"; Key: "(DEFAULT)"; Value: "{9ACF6176-5FC4-4690-A025-B3306A50EB6A}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe -501"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "APPID"; Value: "{FE8B3B95-C80C-41f7-830F-FBA271C26F7E}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe -110"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "(DEFAULT)"; Value: "VeraCrypt class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "ACCESSPERMISSION"; Value: "010004803000000040000000000000001400000002001C00010000000000140007000000010100000000000504000000010200000000000520000000200200000102000000000005200000002002000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\VERACRYPT.EXE"; Key: "APPID"; Value: "{FE8B3B95-C80C-41f7-830F-FBA271C26F7E}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTFORMAT.1"; Key: "(DEFAULT)"; Value: "VeraCryptFormat class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTFORMAT.1\CLSID"; Key: "(DEFAULT)"; Value: "{A96D3797-9F31-49f4-A0CE-9657392CF789}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTFORMAT"; Key: "(DEFAULT)"; Value: "VeraCryptFormat class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTFORMAT\CLSID"; Key: "(DEFAULT)"; Value: "{A96D3797-9F31-49f4-A0CE-9657392CF789}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTFORMAT\CURVER"; Key: "(DEFAULT)"; Value: "VeraCryptFormat.1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "(DEFAULT)"; Value: "VeraCryptFormat class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\PROGID"; Key: "(DEFAULT)"; Value: "VeraCryptFormat.1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "VeraCryptFormat"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\TYPELIB"; Key: "(DEFAULT)"; Value: "{56327DDA-F1A7-4e13-B128-520D129BDEF6}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe -501"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "APPID"; Value: "{A96D3797-9F31-49f4-A0CE-9657392CF789}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe -112"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "(DEFAULT)"; Value: "VeraCryptFormat class"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "ACCESSPERMISSION"; Value: "010004803000000040000000000000001400000002001C00010000000000140007000000010100000000000504000000010200000000000520000000200200000102000000000005200000002002000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\VERACRYPT FORMAT.EXE"; Key: "APPID"; Value: "{A96D3797-9F31-49f4-A0CE-9657392CF789}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{9ACF6176-5FC4-4690-A025-B3306A50EB6A}\2.F"; Key: "(DEFAULT)"; Value: "VeraCrypt Main UAC Support Library"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{9ACF6176-5FC4-4690-A025-B3306A50EB6A}\2.F\FLAGS"; Key: "(DEFAULT)"; Value: "3000000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{9ACF6176-5FC4-4690-A025-B3306A50EB6A}\2.F\0\WIN64"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{9ACF6176-5FC4-4690-A025-B3306A50EB6A}\2.F\HELPDIR"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}"; Key: "(DEFAULT)"; Value: "ITrueCryptMainCom"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\TYPELIB"; Key: "(DEFAULT)"; Value: "{9ACF6176-5FC4-4690-A025-B3306A50EB6A}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\TYPELIB"; Key: "VERSION"; Value: "2.f"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}"; Key: "(DEFAULT)"; Value: "ITrueCryptMainCom"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\TYPELIB"; Key: "(DEFAULT)"; Value: "{9ACF6176-5FC4-4690-A025-B3306A50EB6A}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C786E27C-2801-482C-B45D-D4357B270A29}\TYPELIB"; Key: "VERSION"; Value: "2.f"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}"; Key: "(DEFAULT)"; Value: "ITrueCryptMainCom2"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\TYPELIB"; Key: "(DEFAULT)"; Value: "{9ACF6176-5FC4-4690-A025-B3306A50EB6A}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\TYPELIB"; Key: "VERSION"; Value: "2.f"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}"; Key: "(DEFAULT)"; Value: "ITrueCryptMainCom2"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\TYPELIB"; Key: "(DEFAULT)"; Value: "{9ACF6176-5FC4-4690-A025-B3306A50EB6A}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A0CE3840-6C9F-4521-97B3-6BCC4652ABA6}\TYPELIB"; Key: "VERSION"; Value: "2.f"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{56327DDA-F1A7-4E13-B128-520D129BDEF6}\2.C"; Key: "(DEFAULT)"; Value: "VeraCrypt Format UAC Support Library"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{56327DDA-F1A7-4E13-B128-520D129BDEF6}\2.C\FLAGS"; Key: "(DEFAULT)"; Value: "3000000000"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{56327DDA-F1A7-4E13-B128-520D129BDEF6}\2.C\0\WIN64"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{56327DDA-F1A7-4E13-B128-520D129BDEF6}\2.C\HELPDIR"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}"; Key: "(DEFAULT)"; Value: "ITrueCryptFormatCom"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\TYPELIB"; Key: "(DEFAULT)"; Value: "{56327DDA-F1A7-4E13-B128-520D129BDEF6}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\TYPELIB"; Key: "VERSION"; Value: "2.c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}"; Key: "(DEFAULT)"; Value: "ITrueCryptFormatCom"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\TYPELIB"; Key: "(DEFAULT)"; Value: "{56327DDA-F1A7-4E13-B128-520D129BDEF6}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB357D9-A17F-466E-BCD6-F49E97C218D8}\TYPELIB"; Key: "VERSION"; Value: "2.c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}"; Key: "(DEFAULT)"; Value: "ITrueCryptFormatCom2"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\TYPELIB"; Key: "(DEFAULT)"; Value: "{56327DDA-F1A7-4E13-B128-520D129BDEF6}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\TYPELIB"; Key: "VERSION"; Value: "2.c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}"; Key: "(DEFAULT)"; Value: "ITrueCryptFormatCom2"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{00020424-0000-0000-C000-000000000046}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\TYPELIB"; Key: "(DEFAULT)"; Value: "{56327DDA-F1A7-4E13-B128-520D129BDEF6}"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{86DF18EF-52CA-45C8-8D1B-C00D92BE9380}\TYPELIB"; Key: "VERSION"; Value: "2.c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VERACRYPT"; Key: "INSTALLATIONPATH"; Value: "%PROGRAMFILES%\VeraCrypt\")4f:T903,"Home_VeraCrypt_Creating_Volume.png" has type "PNG image data 704 x 505 8-bit/color RGBA non-interlaced" and extension "png" "Beginner_s Tutorial_Image_002.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_007.jpg" has type "Unknown" and extension "jpg" "Home_VeraCrypt_languages_selection.png" has type "PNG image data 582 x 504 8-bit/color RGBA non-interlaced" and extension "png" "Home_VeraCrypt_NonSysEncryption.png" has type "PNG image data 616 x 410 8-bit/color RGB non-interlaced" and extension "png" "Beginner_s Tutorial_Image_020.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_022.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_017.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_004.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_001.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_015.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_021.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_014.jpg" has type "Unknown" and extension "jpg" "Home_VeraCrypt_Encrypting_Partition.png" has type "PNG image data 606 x 368 8-bit/color RGB non-interlaced" and extension "png" "Beginner_s Tutorial_Image_010.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_005.jpg" has type "Unknown" and extension "jpg" "Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 progressive precision 8 857x743 components 3" and extension "jpg" "Beginner_s Tutorial_Image_016.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_011.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_003.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_008.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_009.jpg" has type "Unknown" and extension "jpg" "Donation_VeraCrypt_BitcoinCash.png" has type "PNG image data 200 x 200 8-bit/color RGB interlaced" and extension "png" "Beginner_s Tutorial_Image_019.jpg" has type "Unknown" and extension "jpg" "Beginner_s Tutorial_Image_018.jpg" has type "Unknown" and extension "jpg"50:Ta9f,Found string "RegOpenKeyTransactedW" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: ADVAPI32.DLL) Found string "RegCreateKeyTransactedW" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyTransactedW" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyExW" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: ADVAPI32.DLL) Found string "LCIDToLocaleName" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "RtlNtStatusToDosError" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: NTDLL.DLL) Found string "NtCreateFile" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: NTDLL.DLL) Found string "RtlGetVersion" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: NTDLL.DLL) Found string "SetDefaultDllDirectories" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemWow64DirectoryW" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process2" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "Wow64EnableWow64FsRedirection" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNEL32.DLL) Found string "SetProcessMitigationPolicy" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadGroupAffinity" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: UCRTBASE.DLL) Found string "AreFileApisANSI" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: VeraCrypt.Setup.1.26.31.exe, API is part of module: KERNELBASE.DLL)51:Tb28,"VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe 1"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\VERACRYPTVOLUME\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe" /v "%1""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "UNINSTALLSTRING"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe" /u"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "MODIFYPATH"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe" /c"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VERACRYPT"; Key: "DISPLAYICON"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe -501"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE8B3B95-C80C-41F7-830F-FBA271C26F7E}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe -110"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe""), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe -501"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A96D3797-9F31-49F4-A0CE-9657392CF789}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe -112"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{9ACF6176-5FC4-4690-A025-B3306A50EB6A}\2.F\0\WIN64"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe"), "VeraCrypt.Setup.1.26.31.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{56327DDA-F1A7-4E13-B128-520D129BDEF6}\2.C\0\WIN64"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe")52:T1594,Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Creating_Volume.png" has high entropy 7.98037 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_languages_selection.png" has high entropy 7.94517 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_NonSysEncryption.png" has high entropy 7.98855 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Encrypting_Partition.png" has high entropy 7.98806 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg" has high entropy 7.82548 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_BitcoinCash.png" has high entropy 7.98304 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_menu_Default_Mount_Parameters.png" has high entropy 7.97692 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Default Mount Parameters_VeraCrypt_password_using_default_parameters.png" has high entropy 7.95672 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Keyfiles in VeraCrypt_Image_040.gif" has high entropy 7.93635 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Bitcoin.png" has high entropy 7.93228 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VC_BTC_Sigwit.png" has high entropy 7.94344 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Ethereum.png" has high entropy 7.93292 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_VeraCrypt_Default_Mount_Parameters.png" has high entropy 7.9336 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Monero.png" has high entropy 7.82575 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Bitcoin_small.png" has high entropy 7.93114 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_VeraCrypt_Litecoin.png" has high entropy 7.868 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Windows_32x32.png" has high entropy 7.94316 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Finder_32x32.png" has high entropy 7.94152 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_Linux_32x32.png" has high entropy 7.93826 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BC_Logo_30x30.png" has high entropy 7.93432 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\freebsd-32x32.png" has high entropy 7.78307 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_PLN.gif" has high entropy 7.09301 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\chm_32x32.png" has high entropy 7.79256 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_canary.png" has high entropy 7.48907 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flattr-badge-large.png" has high entropy 7.50515 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_utilities-file-archiver-3.png" has high entropy 7.70541 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BCH_Logo_48x30.png" has high entropy 7.84638 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-gb.png" has high entropy 7.73905 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_RaspberryPi_32x32.png" has high entropy 7.86198 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\bank_30x30.png" has high entropy 7.86501 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\BCH_Logo_30x30.png" has high entropy 7.86216 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_Dollars.gif" has high entropy 7.18982 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_GBP.gif" has high entropy 7.16448 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_YEN.gif" has high entropy 7.18408 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\LTC_Logo_30x30.png" has high entropy 7.83428 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_Euros.gif" has high entropy 7.18703 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate_CHF.gif" has high entropy 7.21534 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-eu.png" has high entropy 7.86073 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Donation_donate.gif" has high entropy 7.20765 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-au.png" has high entropy 7.5396 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-nz.png" has high entropy 7.54062 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_reddit.png" has high entropy 7.79374 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-us.png" has high entropy 7.3156 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-au-small.png" has high entropy 7.21084 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-gb-small.png" has high entropy 7.22951 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-us-small.png" has high entropy 7.16238 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-eu-small.png" has high entropy 7.01397 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Ethereum_Logo_19x30.png" has high entropy 7.66204 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_facebook_veracrypt.png" has high entropy 7.67675 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\flag-nz-small.png" has high entropy 7.09884 Dropped file "%PROGRAMFILES%\VeraCrypt\docs\html\zh-cn\Home_tibitDonateButton.png" has high entropy 7.4972553:T7b9,"VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.986293054698718" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.981321398551358" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.984296314130463" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.9813646458927705" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.985946779224142" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.984082921701229" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.985069030349935" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.983373651732791" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.985678523131456" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.985706862684451" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.982464336408592" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.98169368476416" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.98761255877515" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.982327063066805" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.982823646444362" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.985208035254214" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.982165157347716" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.982811298861329" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.981613366395616" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.980293212497312" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.275874789114656" "VeraCrypt.Setup.1.26.31.exe" has resource with unusual entropy "BIN:7.278054732355579"54:T442,"VeraCryptExpander.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCryptExpander.exe]- [targetUID: 00000000-00005460] "VeraCrypt.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt.exe]- [targetUID: 00000000-00005460] "VeraCrypt Setup.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 7 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt Setup.exe]- [targetUID: 00000000-00005460] "VeraCrypt Format.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\VeraCrypt\VeraCrypt Format.exe]- [targetUID: 00000000-00005460] "veracrypt.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections"- Location: [%PROGRAMFILES%\VeraCrypt\veracrypt.sys]- [targetUID: 00000000-00005460] "veracrypt.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections"- Location: [%WINDIR%\System32\drivers\veracrypt.sys]- [targetUID: 00000000-00005460]55:T7c9,"VeraCrypt.Setup.1.26.31.exe" wrote 5408 bytes starting with PE header signature to file "C:\Program Files\VeraCrypt\VeraCrypt.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VeraCrypt.Setup.1.26.31.exe" wrote 50464 bytes starting with PE header signature to file "C:\Program Files\VeraCrypt\VeraCryptExpander.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VeraCrypt.Setup.1.26.31.exe" wrote 42272 bytes starting with PE header signature to file "C:\Program Files\VeraCrypt\VeraCrypt Format.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VeraCrypt.Setup.1.26.31.exe" wrote 14008 bytes starting with PE header signature to file "C:\Program Files\VeraCrypt\veracrypt.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VeraCrypt.Setup.1.26.31.exe" wrote 14008 bytes starting with PE header signature to file "C:\Windows\System32\drivers\veracrypt.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...56:Tb16,"VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "VeraCrypt.Setup.1.26.31.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAj3AAAAAAAAAAAAAAAAf/8ADwAAAAAAAAAAAAB//wAAABAHAAAAAAAAAAj/AAAHd3eHAA8AAAAAAP8AAAd3d3d3eHcAcAAAAABwB3d3d3d3d3d3cAfwAAAAd3d3ZmZmZmdnd3dwCAAAAIdiAAAiImZiaId3dwB/AACHdgAAAAACZ3/4h3d3AHAAdmZgAAAnd4iIj4iHd3AAAHAABmd4iIiIiIiPiId3AACHeIiP/4iI+IiIiI+IeHAA/////4j//4iIiIh4/4iAcIB4j///////iIiIiIj/gPCPgA//////////iIiIiICAAAAAAAd4/4iI/4iIiIcAAAAAAAAAAPiHiIiIcAAAgAAAAAAAZmZgYAAAAA+IiAAAAGBmZ2ZmYGB4+IiAAAAAAAAGZmZmZgYAAAAAAAAAAAAGBmZmZgZgAAAAAAAAAAAAAAZgZmB3AAAAAAAAAAAAAGBmYGZwCIAAAAAAAAAAAAAAZgcHd4gIAAAAAAAAAAAADuYGB3eIgIAAAAAAAAAAAAAGAIB3iICAAAAAAAAAAAAA5gAHAAiAAAAAAAAAAAAAAAAAAHeIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+D///wAP//AAB/+AAAH/AAAA/wAAAD8AAAAfAAAADwAAAAeAAAAH8AAAB/4AAA//gAB/6/gf///////5D///8A////R////k////7n///84////fD////4///////////////////////////////////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1794204989073,"unified_at":"2026-11-09T06:16:29.073Z","metadata":{"hashes":{"sha256":"9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","sha1":"8030ba3f6ec46fa0331c554e4bf058d67728e175","md5":"2122a8666dbd5448dd47de97c1f0fcef","sha512":"85d67cd1edb44bde0132668e0ea0a2c2fdad656984f8f0b2e50a4b1f20d61f2b54206bc3be6dd488a75314ecda21961db2c0f2774806944f579e3c15c576fc08","ssdeep":"786432:UcrRZW9p56mOk9A85iu6J0LRGADI8xrI06+qEuDV8j4EEbz3Y30HR9QduQ46Iffo:UcrRZW9p56mOk9A85iu6J0LRGADI8xrd","ssdeep_chunks":["786432:UcrRZW9","786432:crRZW9p","786432:rRZW9p5","786432:RZW9p56","786432:ZW9p56m","786432:W9p56mO","786432:9p56mOk","786432:p56mOk9","786432:56mOk9A","786432:6mOk9A8","786432:mOk9A85","786432:Ok9A85i","786432:k9A85iu","786432:9A85iu6","786432:A85iu6J","786432:85iu6J0","786432:5iu6J0L","786432:iu6J0LR","786432:u6J0LRG","786432:6J0LRGA","786432:J0LRGAD","786432:0LRGADI","786432:LRGADI8","786432:RGADI8x","786432:GADI8xr","786432:ADI8xrI","786432:DI8xrI0","786432:I8xrI06","786432:8xrI06+","786432:xrI06+q","786432:rI06+qE","786432:I06+qEu","786432:06+qEuD","786432:6+qEuDV","786432:+qEuDV8","786432:qEuDV8j","786432:EuDV8j4","786432:uDV8j4E","786432:DV8j4EE","786432:V8j4EEb","786432:8j4EEbz","786432:j4EEbz3","786432:4EEbz3Y","786432:EEbz3Y3","786432:Ebz3Y30","786432:bz3Y30H","786432:z3Y30HR","786432:3Y30HR9","786432:Y30HR9Q","786432:30HR9Qd","786432:0HR9Qdu","786432:HR9QduQ","786432:R9QduQ4","786432:9QduQ46","786432:QduQ46I","786432:duQ46If","786432:uQ46Iff","786432:Q46Iffo","1572864:UcrRZW9","1572864:crRZW9p","1572864:rRZW9p5","1572864:RZW9p56","1572864:ZW9p56m","1572864:W9p56mO","1572864:9p56mOk","1572864:p56mOk9","1572864:56mOk9A","1572864:6mOk9A8","1572864:mOk9A85","1572864:Ok9A85i","1572864:k9A85iu","1572864:9A85iu6","1572864:A85iu6J","1572864:85iu6J0","1572864:5iu6J0L","1572864:iu6J0LR","1572864:u6J0LRG","1572864:6J0LRGA","1572864:J0LRGAD","1572864:0LRGADI","1572864:LRGADI8","1572864:RGADI8x","1572864:GADI8xr","1572864:ADI8xrI","1572864:DI8xrI0","1572864:I8xrI06","1572864:8xrI06+","1572864:xrI06+q","1572864:rI06+qE","1572864:I06+qEu","1572864:06+qEuD","1572864:6+qEuDV","1572864:+qEuDV8","1572864:qEuDV8j","1572864:EuDV8j4","1572864:uDV8j4E","1572864:DV8j4EE","1572864:V8j4EEb","1572864:8j4EEbz","1572864:j4EEbz3","1572864:4EEbz3Y","1572864:EEbz3Y3","1572864:Ebz3Y30","1572864:bz3Y30H","1572864:z3Y30HR","1572864:3Y30HR9","1572864:Y30HR9Q","1572864:30HR9Qd","1572864:0HR9Qdu","1572864:HR9QduQ","1572864:R9QduQ4","1572864:9QduQ46","1572864:QduQ46I","1572864:duQ46If","1572864:uQ46Iff","1572864:Q46Iffo","786432:ADI8xrd"],"imphash":"6c460e93b9f3d033d6d8ddffb3bbf05c"},"file_info":{"file_name":"VeraCrypt.Setup.1.26.31.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":44541680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793833867000,"last_seen":1794204680000,"last_multi_scan":1794204680000}},"detections":{"summary":{"verdict":"malicious","score":80,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":194,"suspicious_count":22,"malicious_count":3,"total":219},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Suspicious:Packed.Krap.ao.qjxi.mg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Suspicious:Packed.Krap.ao.qjxi","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Drops a license file"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Lateral Movement","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","identifiers":[{"type":"suspicious","value":"Has the ability to infect usb drives"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"malicious","value":"Drops system driver"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to delete device driver (API string)"},{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"References bcrypt module and functions (used for encryption/decryption)"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Credential Access","technique":"Steal or Forge Authentication Certificates","attack_id":"T1649","attack_id_wiki":"https://attack.mitre.org/techniques/T1649","identifiers":[{"type":"informative","value":"Contains reference to authentication certificates (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform CAST-128/CAST-256 encryption"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"suspicious","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"informative","value":"Contains ability to format file system volume on a partition (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-542","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$36","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegGetValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyTransactedW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"Found string \"C:\\dev\\prj\\Github\\VeraCrypt\\src\\Setup\\Release\\VeraCryptSetup.pdb\" (Indicator: \"github\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1213.003","id":"string-774","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_QuickFixEngineering\" (Indicator: \" Win32_QuickFixEngineering\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\VeraCrypt\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-227","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"ASeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$39","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"SHDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteTreeW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"System32\\drivers\\veracrypt.sys\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), Found string \"System32\\drivers\\veracrypt.sys\" (Indicator: \"system32\\drivers\"; Source: \"sample.bin\"), Found string \"\\Device\\Harddisk\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\DosDevices\\\" (Indicator: \"\\DosDevices\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-402","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-10073","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"VeraCrypt::Elevator::DeviceIoControl:822\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"bootmgfw.pdb\", \"C:\\dev\\prj\\Github\\VeraCrypt\\src\\Setup\\Release\\VeraCryptSetup.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_QuickFixEngineering\" (Source: sample.bin, Indicator: \"select * from win32_quickfixengineering\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"AuthzFreeResourceManager\" (Indicator: \"FreeResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in \"sample.bin\", Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"smueller@chronox.de\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"C:\\Windows\\System32\\srclient.dll\" [Source: sample.bin], Observed system executable string:\"C:\\Windows\\System32\\PowrProf.dll\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"(0) TEST ALL (1) SHA512 (2) WHIRLPOOL (3) SHA256 (4) BLAKE2S (5) STREEBOG\nHash: \" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"Rijndael\" (Indicator: \"Rijndael\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\VeraCrypt; Source: \"sample.bin\"), Found string - \\\\.\\X:; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\"), Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"sample.bin\", Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"NtQuerySystemInformation\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; Source: \"sample.bin\"), Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; Source: \"sample.bin\"), Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1006","id":"string-194","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\"), Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_QuickFixEngineering\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatusEx\" (Source: \"sample.bin\"), Found string \"QueryServiceStatus\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\"), Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"VeraCrypt::BootEncryption::GetWindowsDirectoryW:1538\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\VeraCrypt\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"veracrypt-x64.cat\", Heuristic match: \"efi\\microsoft\\boot\\bootmgfw_ms.vc\", Heuristic match: \"veracrypt.cat\", Heuristic match: \"amcrypto.jp\", Heuristic match: \"averacrypt.cat\", Pattern match: \"http://www.truecrypt.org/\", Heuristic match: \"veracrypt-arm64.cat\", Heuristic match: \"\\efi\\microsoft\\boot\\bootmgfw_ms.vc\", Pattern match: \"https://veracrypt.jp\", Pattern match: \"https://cdburnerxp.se/en/home\", Heuristic match: \"docs\\html\\en\\linuxprepandbuild.sh\", Pattern match: \"www.adobe.com\", Pattern match: \"https://veracrypt.jp/%s/documentation.html\", Pattern match: \"https://veracrypt.jp/%s/%s\", Pattern match: \"https://amcrypto.jp\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://veracrypt.jp\", Found HTTPS url \"https://cdburnerxp.se\", Found HTTPS url \"https://amcrypto.jp\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to infect usb drives","description":"\" (autorun.inf)\n \" (Indicator: \"autorun.inf\") in Source: sample.bin, \"autorun.inf\" (Indicator: \"autorun.inf\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1091","id":"string-175","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"\\ntldr\" (Indicator: \"ntldr\")","origin":"sample.bin","id":"string-0","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"unknown compression method\" (Source: \"00000000-00005460.00000002.182118.00488000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"VeraCrypt.Setup.1.26.31.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"VeraCrypt.Setup.1.26.31.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"VeraCrypt.Setup.1.26.31.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CAST-128/CAST-256 encryption","description":"Found string \"CAST-128\" (Indicator: \"CAST-128\"; File: \"VeraCrypt.Setup.1.26.31.exe\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":1,"id":"string-599","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005460.00000000.180164.0426F000.00000004.mdmp, 00000000-00005460.00000001.182085.041F0000.00000004.mdmp, 00000000-00005460.00000002.182118.04293000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"CompilingGuidelineWin.html\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"Downloads.html\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"CompilingGuidelineLinux.html\")\n file/memory contains long string with (Indicator: \"paypal.com\"; File: \"Donation.html\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"Code.html\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"VeraCrypt.Setup.1.26.31.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"VeraCrypt.Setup.1.26.31.exe\" queried token user identity (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"VeraCrypt.Setup.1.26.31.exe\" queries volume information of \"C:\\Program Files\\VeraCrypt\" at 00000000-00005460-00000C17-1204465719\n \"VeraCrypt.Setup.1.26.31.exe\" queries volume information of \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VeraCrypt\" at 00000000-00005460-00000C17-1210372546\n \"VeraCrypt.Setup.1.26.31.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005460-00000C17-1210407935\n \"VeraCrypt.Setup.1.26.31.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005460-00000C17-1210628349\n \"VeraCrypt.Setup.1.26.31.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005460-00000C17-1210644858","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\VERACRYPT\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\VERACRYPT.SETUP.1.26.31.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005460.00000002.182118.00488000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005460.00000002.182118.00488000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$41","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: VeraCrypt.Setup.1.26.31.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:64:WilError_03\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:168:WilStaging_02\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"Local\\SM0:5460:168:WilStaging_02\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"SM0:5460:64:WilError_03\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"SM0:5460:168:WilStaging_02\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"Local\\SM0:5460:64:WilError_03\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:168:WilStaging_02\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:64:WilError_03\"\n Process VeraCrypt.Setup.1.26.31.exe created mutex with name \"\\BaseNamedObjects\\VeraCrypt Setup\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$42","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"VeraCrypt.Setup.1.26.31.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"veracrypt.sys\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"VeraCrypt.Setup.1.26.31.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 75590000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"VeraCrypt.Setup.1.26.31.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75A20000\n \"VeraCrypt.Setup.1.26.31.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76E20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"VeraCrypt.Setup.1.26.31.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76BA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"VeraCrypt.Setup.1.26.31.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"veracrypt.sys\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"VeraCrypt.Setup.1.26.31.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"VeraCrypt.Setup.1.26.31.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"VeraCrypt.Setup.1.26.31.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"VeraCrypt.Setup.1.26.31.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"veracrypt.sys\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"VeraCrypt.Setup.1.26.31.exe\" has an executable section named \".text\"\n \"veracrypt.sys\" has an executable section named \".text\"\n \"veracrypt.sys\" has an executable section named \"INIT\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"VeraCrypt.Setup.1.26.31.exe\" has an writable section named \".data\"\n \"VeraCrypt.Setup.1.26.31.exe\" has an writable section named \".didat\"\n \"VeraCrypt.Setup.1.26.31.exe\" has an writable section named \".fptable\"\n \"veracrypt.sys\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"VeraCrypt.Setup.1.26.31.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,sub\tesp, 0xc,push\tesi,push\t0x492144,push\t0x48bbd8,call\tdword ptr [0x488020],push\teax,call\tdword ptr [0x488024],mov\tesi, eax,test\tesi, esi,je\t0x43106e,push\t0x48a248,call\tdword ptr [0x488164],push\t0x800,mov\tecx, esi,call\tdword ptr [0x488294],call\tesi,push\t0x493688,push\t0x48bbd8,call\tdword ptr [0x488020],push\teax,call\tdword ptr [0x488024],mov\tesi, eax,test\tesi, esi,je\t0x4310d6,push\t4,lea\teax, [ebp - 4],\"\n \"veracrypt.sys\" file has an entrypoint instructions - \"mov\tqword ptr [rsp + 8], rbx,push\trdi,sub\trsp, 0x20,mov\trbx, rdx,mov\trdi, rcx,call\t0x1400b535c,mov\trdx, rbx,mov\trcx, rdi,call\t0x1400b5000,mov\trbx, qword ptr [rsp + 0x30],add\trsp, 0x20,pop\trdi,ret\t,int3\t,mov\trax, qword ptr [rip - 0x161a3],test\trax, rax,je\t0x1400b5383,movabs\trcx, 0x2b992ddfa232,cmp\trax, rcx,je\t0x1400b5383,not\trax,mov\tqword ptr [rip - 0x161b9], rax,ret\t,int3\t,mov\tecx, 6,int\t0x29,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,pop\trsp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x15f7600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x15f75d0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"veracrypt.sys\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 4C:5D:80:D2:CD:06:B1:A4:93:C4:9B:2E:9B:ED:4A:57:C2:F8:73:E5; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE\" (SHA1: C1:0B:B7:6A:D4:EE:81:52:42:40:6A:1E:3E:11:17:FF:EC:74:3D:4F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE\" (SHA1: 86:E1:D4:26:73:1E:79:11:74:52:F0:90:18:8A:82:84:26:B2:9B:5F; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"VeraCrypt.Setup.1.26.31.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"VeraCrypt.Setup.1.26.31.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"VeraCrypt.Setup.1.26.31.exe\" create file \"C:\\Windows\\System32\\drivers\\veracrypt.sys\"\n \"VeraCrypt.Setup.1.26.31.exe\" create file \"%WINDIR%\\System32\\drivers\\veracrypt.sys\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"veracrypt.inf\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"License.txt\" has type \"Unknown\"- Location: [%PROGRAMFILES%\\VeraCrypt\\License.txt]- [targetUID: 00000000-00005460]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"VeraCrypt.Setup.1.26.31.exe\" queries basic process information of the \"C:\\VeraCrypt.Setup.1.26.31.exe\" (UID: 5460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"VeraCrypt.Setup.1.26.31.exe\" reads file \"c:\\veracrypt.setup.1.26.31.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"VeraCrypt.Setup.1.26.31.exe\" touched file \"C:\\Windows\\System32\\drivers\\veracrypt.sys\"\n \"VeraCrypt.Setup.1.26.31.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"VeraCrypt.Setup.1.26.31.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VeraCrypt\\VeraCrypt.lnk\"\n \"VeraCrypt.Setup.1.26.31.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VeraCrypt\\VeraCryptExpander.lnk\"\n \"VeraCrypt.Setup.1.26.31.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VeraCrypt\\Uninstall VeraCrypt.lnk\"\n \"VeraCrypt.Setup.1.26.31.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VeraCrypt\\VeraCrypt User's Guide.lnk\"\n \"VeraCrypt.Setup.1.26.31.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\VeraCrypt.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\license.txt\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\license\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\notice\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt.exe\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracryptexpander.exe\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt format.exe\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt.inf\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt.cat\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt.sys\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\windows\\system32\\drivers\\veracrypt.sys\"\n \"VeraCrypt.Setup.1.26.31.exe\" writes file \"c:\\program files\\veracrypt\\veracrypt setup.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" bind \"; File: \"LICENSE\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.29.31\"\n \"2.5.4.3\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"VeraCryptExpander.exe\"\n YARA signature matched on embedded PE in file \"VeraCrypt Format.exe\"\n YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in file \"VeraCrypt.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"VeraCrypt Setup.exe\"\n YARA signature for encryption algorithm file \"VeraCrypt Format.exe\"\n YARA signature for encryption algorithm file \"sample.bin\"\n YARA signature for encryption algorithm process \"00000000-00005460\"\n YARA signature for encryption algorithm file \"VeraCrypt.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: VeraCrypt.Setup.1.26.31.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"EFISecureBoot.html\")\n file/memory contains long string with (Indicator: \"Select-Object\"; File: \"EFISecureBoot.html\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to format file system volume on a partition (API string)","description":"Found reference to API \"FormatEx\" (Indicator: \"FormatEx\"; File: \"VeraCrypt.Setup.1.26.31.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.005","relevance":1,"id":"string-483","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-WinEvent\"; File: \"EFISecureBoot.html\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: VeraCrypt.Setup.1.26.31.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"VeraCrypt.Setup.1.26.31.exe\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \":loopdel \"%s%s\"if exist \"%s%s\" goto looprmdir \"%s\"del \"%s\"\" (Indicator: \"\"del \") in Source: VeraCrypt.Setup.1.26.31.exe","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Contains reference to authentication certificates (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-PfxCertificate\"; File: \"EFISecureBoot.html\")","origin":"File/Memory","mitre_attack_id":"T1649","relevance":1,"id":"string-391","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VERACRYPT\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VERACRYPT\"; Key: \"INSTALLATIONPATH\"; Value: \"%PROGRAMFILES%\\VeraCrypt\\\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1685","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"CopySid\" which can \"copy a security identifier (SID) to a buffer\" [Source: veracrypt.sys]\n Observed import api \"EqualSid\" which can \"test two security identifier (SID) values for equality\" [Source: veracrypt.sys]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"VeraCrypt.Setup.1.26.31.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"VeraCrypt.Setup.1.26.31.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VERACRYPT\"; Key: \"INSTALLATIONPATH\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"VeraCrypt.Setup.1.26.31.exe\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"VeraCrypt.Setup.1.26.31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".rsrc\" unusually large (23033296 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"$51","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"veracrypt.sys\" has section name .rdata with entropy \"7.796399343053564\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.zh-cn.chm\" has high entropy 7.99753\n Dropped file \"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.chm\" has high entropy 7.99672\n Dropped file \"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.ru.chm\" has high entropy 7.99638\n Dropped file \"%PROGRAMFILES%\\VeraCrypt\\veracrypt.cat\" has high entropy 7.35138\n Dropped file \"%PROGRAMFILES%\\VeraCrypt\\veracrypt.sys\" has high entropy 7.31305\n Dropped file \"%WINDIR%\\System32\\drivers\\veracrypt.sys\" has high entropy 7.31305","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"$52","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"References bcrypt module and functions (used for encryption/decryption)","description":"Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00005460.00000002.182118.00488000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1573","relevance":5,"id":"memorydump-14","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"VeraCrypt.Setup.1.26.31.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\VeraCrypt.Setup.1.26.31.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/24 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$53","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$55","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"VeraCryptExpander.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"VeraCryptExpander.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"veracrypt.sys\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"veracrypt.sys\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"VeraCrypt Format.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"VeraCrypt Format.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"VeraCrypt.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"VeraCrypt.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Program Files\\Common Files\\VeraCryptSystem\\SetupComplete.cmd\" with delete access\n \"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Program Files\\Common Files\\VeraCryptSystem\\Drivers\\veracrypt.inf\" with delete access\n \"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Program Files\\Common Files\\VeraCryptSystem\\Drivers\\veracrypt.sys\" with delete access\n \"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Program Files\\Common Files\\VeraCryptSystem\\Drivers\\veracrypt.cat\" with delete access\n \"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Program Files\\Common Files\\VeraCryptSystem\\Drivers\" with delete access\n \"VeraCrypt.Setup.1.26.31.exe\" opened \"C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WSUS\\VeraCrypt-SetupConfig.lock\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"VeraCrypt.Setup.1.26.31.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$56","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"veracrypt.sys\" claimed CRC 44550673 while the actual is CRC 726892","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n WriteFile\n LoadLibraryW\n FindFirstFileExW\n CreateProcessW\n LockResource\n TerminateProcess\n GetNativeSystemInfo\n GetProcAddress\n GetModuleHandleExW\n LoadLibraryExW\n GetStartupInfoW\n GetFileAttributesExW\n GetModuleFileNameW\n FindNextFileW\n FindResourceW\n GetFileAttributesW\n IsDebuggerPresent\n Sleep\n VirtualAlloc\n GetCommandLineW\n GetModuleHandleW\n GetTickCount\n GetTempPathW\n DeleteFileW\n CreateDirectoryW\n CopyFileW\n CreateFileW\n GetTickCount64\n LoadLibraryExA\n GetDriveTypeW\n CreateThread\n ExitThread\n SleepConditionVariableSRW\n OpenProcess\n VirtualProtect\n GetSystemDirectoryW\n GetFileSize\n GetFileSizeEx\n OutputDebugStringW\n UnhandledExceptionFilter\n DeviceIoControl\n FindFirstFileW\n GetCommandLineA\n ZwQueryInformationFile","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections\" was dropped at \"%WINDIR%\\System32\\drivers\\veracrypt.sys\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"veracrypt.sys\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 7 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}],"intel_graph":{"map":{"File:00d7f152e2c7415332aa4343051c46c480c6425b81d1bcbf8782fcc13fb7ad11":{"type":"File","value":"00d7f152e2c7415332aa4343051c46c480c6425b81d1bcbf8782fcc13fb7ad11"},"File:03e58f3be3aedd197dd8b6f1020cc0f58202bfe6a686182167fbb9612f709d99":{"type":"File","value":"03e58f3be3aedd197dd8b6f1020cc0f58202bfe6a686182167fbb9612f709d99"},"File:0c70c997f1b85614cebb99e737d9f3d1175f978fe061432f4e043feab626b17b":{"type":"File","value":"0c70c997f1b85614cebb99e737d9f3d1175f978fe061432f4e043feab626b17b"},"File:1c5a5d2d3fb7805e5cb095f6d34cd90f8a5a1bbd9fb780c2681e3910bba1a205":{"type":"File","value":"1c5a5d2d3fb7805e5cb095f6d34cd90f8a5a1bbd9fb780c2681e3910bba1a205"},"File:1c5c455cea7636acb04d975a4dd990a23aa9a7d27d6ab6535038ce5dc16cd553":{"type":"File","value":"1c5c455cea7636acb04d975a4dd990a23aa9a7d27d6ab6535038ce5dc16cd553"},"File:2b4d870e4b2cbbd7d322db267f47629f95fc0716f400df6a94352e6791a90734":{"type":"File","value":"2b4d870e4b2cbbd7d322db267f47629f95fc0716f400df6a94352e6791a90734"},"File:3604a024af5fabc6d5ca73271e199e7f4e0207d36fd4fdd7518684422bed6e28":{"type":"File","value":"3604a024af5fabc6d5ca73271e199e7f4e0207d36fd4fdd7518684422bed6e28"},"File:3658b9de85f04e4a58fe84ea936b3baad3083d7b132ee94692627b5207967061":{"type":"File","value":"3658b9de85f04e4a58fe84ea936b3baad3083d7b132ee94692627b5207967061"},"File:3c16a5e76bfad0509701da833b894bc94425cd2a948d46862504fd681a47b55a":{"type":"File","value":"3c16a5e76bfad0509701da833b894bc94425cd2a948d46862504fd681a47b55a"},"File:3c40e0f37e45be3c58c6923c018f71373b010aa16434889c99ffcb8559654d7d":{"type":"File","value":"3c40e0f37e45be3c58c6923c018f71373b010aa16434889c99ffcb8559654d7d"},"File:3eeebdff9aa378d633b52cb16a2a88308e8d85b639ca240219304d2429781aa1":{"type":"File","value":"3eeebdff9aa378d633b52cb16a2a88308e8d85b639ca240219304d2429781aa1"},"File:3f3737f1f93e0c4bbd16b87c764b50034a3ddb82a2abf4400311b7f08ea24a48":{"type":"File","value":"3f3737f1f93e0c4bbd16b87c764b50034a3ddb82a2abf4400311b7f08ea24a48"},"File:43485f72bfd0d219e8d69c680ebf72a383054cb4c6544d70ee8657dd959cacbe":{"type":"File","value":"43485f72bfd0d219e8d69c680ebf72a383054cb4c6544d70ee8657dd959cacbe"},"File:48eec5cac60ebf34aa4931057f388bbcbe22df8fb57b51110ca451c3c368bc89":{"type":"File","value":"48eec5cac60ebf34aa4931057f388bbcbe22df8fb57b51110ca451c3c368bc89"},"File:4c1897c66f195c9e3778ed558baa65f7d0118da031b11de114e777b51b7fc622":{"type":"File","value":"4c1897c66f195c9e3778ed558baa65f7d0118da031b11de114e777b51b7fc622"},"File:56fd7a7a8969a296e7f6dabd7041f514d3042fe5074c47f0e9d047c01f714130":{"type":"File","value":"56fd7a7a8969a296e7f6dabd7041f514d3042fe5074c47f0e9d047c01f714130"},"File:58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b":{"type":"File","value":"58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:66f4ddcc393381479f18282ad403eb61030a7e4bcf92ad391429bb8b1880762b":{"type":"File","value":"66f4ddcc393381479f18282ad403eb61030a7e4bcf92ad391429bb8b1880762b"},"File:74210a1902a73324ec8b6de91d39c3948e06583fadc744b3dfeac1f1e679e44f":{"type":"File","value":"74210a1902a73324ec8b6de91d39c3948e06583fadc744b3dfeac1f1e679e44f"},"File:8800efa54e79b2b8be6fd58c5921fc4bc9c81c58ce4bfcf8f336a9c1fae32d45":{"type":"File","value":"8800efa54e79b2b8be6fd58c5921fc4bc9c81c58ce4bfcf8f336a9c1fae32d45"},"File:8b5b461d58d601f31ed9540310cac3c00abe471849b4700fda3a0c03556f4ee4":{"type":"File","value":"8b5b461d58d601f31ed9540310cac3c00abe471849b4700fda3a0c03556f4ee4"},"File:941a8b7f7962691eba1c419017d059327d5fc7944e7c9fa754ed2d7cdc26cc75":{"type":"File","value":"941a8b7f7962691eba1c419017d059327d5fc7944e7c9fa754ed2d7cdc26cc75"},"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615":{"type":"File","value":"9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","filetype":"PE32 executable for MS Windows 6.00 (GUI), Intel i386, 7 sections","filetype_short":"PE32"},"File:a1b39a8ef895cd48b35c553a879fcc8b4e6b4aeb4684b23716ec4a5218884393":{"type":"File","value":"a1b39a8ef895cd48b35c553a879fcc8b4e6b4aeb4684b23716ec4a5218884393"},"File:b4159c6db7ad6ba1a4f2045f7361612ff08e64c15993d4b04cd7ecdf6439b372":{"type":"File","value":"b4159c6db7ad6ba1a4f2045f7361612ff08e64c15993d4b04cd7ecdf6439b372"},"File:b5dc0099b27a6ed22d9353d2d24e5bfdfb65d53a881b8209923a8bf805aa1abe":{"type":"File","value":"b5dc0099b27a6ed22d9353d2d24e5bfdfb65d53a881b8209923a8bf805aa1abe"},"File:b94f59da4b4910fd8854814fc31c2a9f757a1c23f92a92e6c18ed15cdc6cae6d":{"type":"File","value":"b94f59da4b4910fd8854814fc31c2a9f757a1c23f92a92e6c18ed15cdc6cae6d"},"File:bcbea674d1a6ab94e812ce3eba6b2ab997052d65ef7d82baba80a6ef97d66cad":{"type":"File","value":"bcbea674d1a6ab94e812ce3eba6b2ab997052d65ef7d82baba80a6ef97d66cad"},"File:c5f2e7f8d50c52d333d24a635ac156257603772c358135358ab01032d559bead":{"type":"File","value":"c5f2e7f8d50c52d333d24a635ac156257603772c358135358ab01032d559bead"},"File:d229ad70e01d1b07a1c4e16b1515697f08dcb2b921c57c935791b2ac04f68066":{"type":"File","value":"d229ad70e01d1b07a1c4e16b1515697f08dcb2b921c57c935791b2ac04f68066"},"File:fc02e001600d4ae4aa4c3f93ba399a2315bc052c9d262be1b6f3bacc00ef1f15":{"type":"File","value":"fc02e001600d4ae4aa4c3f93ba399a2315bc052c9d262be1b6f3bacc00ef1f15"}},"chains":[{"id":"1569232939309725615","root":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","edges":[{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:8800efa54e79b2b8be6fd58c5921fc4bc9c81c58ce4bfcf8f336a9c1fae32d45"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:fc02e001600d4ae4aa4c3f93ba399a2315bc052c9d262be1b6f3bacc00ef1f15"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:0c70c997f1b85614cebb99e737d9f3d1175f978fe061432f4e043feab626b17b"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:43485f72bfd0d219e8d69c680ebf72a383054cb4c6544d70ee8657dd959cacbe"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:8b5b461d58d601f31ed9540310cac3c00abe471849b4700fda3a0c03556f4ee4"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3f3737f1f93e0c4bbd16b87c764b50034a3ddb82a2abf4400311b7f08ea24a48"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:66f4ddcc393381479f18282ad403eb61030a7e4bcf92ad391429bb8b1880762b"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3c16a5e76bfad0509701da833b894bc94425cd2a948d46862504fd681a47b55a"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:941a8b7f7962691eba1c419017d059327d5fc7944e7c9fa754ed2d7cdc26cc75"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3604a024af5fabc6d5ca73271e199e7f4e0207d36fd4fdd7518684422bed6e28"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:56fd7a7a8969a296e7f6dabd7041f514d3042fe5074c47f0e9d047c01f714130"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:1c5a5d2d3fb7805e5cb095f6d34cd90f8a5a1bbd9fb780c2681e3910bba1a205"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:48eec5cac60ebf34aa4931057f388bbcbe22df8fb57b51110ca451c3c368bc89"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:00d7f152e2c7415332aa4343051c46c480c6425b81d1bcbf8782fcc13fb7ad11"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:c5f2e7f8d50c52d333d24a635ac156257603772c358135358ab01032d559bead"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:74210a1902a73324ec8b6de91d39c3948e06583fadc744b3dfeac1f1e679e44f"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:bcbea674d1a6ab94e812ce3eba6b2ab997052d65ef7d82baba80a6ef97d66cad"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3c40e0f37e45be3c58c6923c018f71373b010aa16434889c99ffcb8559654d7d"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:03e58f3be3aedd197dd8b6f1020cc0f58202bfe6a686182167fbb9612f709d99"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:b4159c6db7ad6ba1a4f2045f7361612ff08e64c15993d4b04cd7ecdf6439b372"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:a1b39a8ef895cd48b35c553a879fcc8b4e6b4aeb4684b23716ec4a5218884393"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:4c1897c66f195c9e3778ed558baa65f7d0118da031b11de114e777b51b7fc622"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:2b4d870e4b2cbbd7d322db267f47629f95fc0716f400df6a94352e6791a90734"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3658b9de85f04e4a58fe84ea936b3baad3083d7b132ee94692627b5207967061"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:3eeebdff9aa378d633b52cb16a2a88308e8d85b639ca240219304d2429781aa1"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:1c5c455cea7636acb04d975a4dd990a23aa9a7d27d6ab6535038ce5dc16cd553"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:d229ad70e01d1b07a1c4e16b1515697f08dcb2b921c57c935791b2ac04f68066"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:b5dc0099b27a6ed22d9353d2d24e5bfdfb65d53a881b8209923a8bf805aa1abe"},{"edge_kind":"extracted","from_key":"File:9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","to_key":"File:b94f59da4b4910fd8854814fc31c2a9f757a1c23f92a92e6c18ed15cdc6cae6d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":308,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6af1640549c2e89b1506b6c0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Suspicious:Packed.Krap.ao.qjxi","submit_name":"VeraCrypt.Setup.1.26.31.exe","analysis_start_time":"2026-11-09T06:11:22+00:00","indicators_count":{"informative":194,"suspicious":31,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}],"processes":[{"pid":5460,"ppid":0,"name":"VeraCrypt.Setup.1.26.31.exe","command_line":"","sha256":"9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615","normalized_path":"C:\\VeraCrypt.Setup.1.26.31.exe","uid":"00000000-00005460","icon":"$57"}],"all_imported_dlls":["ntshrui.dll","comctl32.dll","msvcp_win.dll","advapi32.dll","ntmarta.dll","combase.dll","uxtheme.dll","srvcli.dll","bcryptprimitives.dll","wow64win.dll","TextInputFramework.dll","riched20.dll","oleaut32.dll","msasn1.dll","CoreMessaging.dll","linkinfo.dll","sechost.dll","rpcrt4.dll","KernelBase.dll","bcrypt.dll","clbcatq.dll","crypt32.dll","gdi32.dll","kernel.appcore.dll","profapi.dll","cscapi.dll","gdi32full.dll","msctf.dll","rsaenh.dll","ucrtbase.dll","imm32.dll","windows.storage.dll","SHCore.dll","propsys.dll","cryptsp.dll","win32u.dll","usp10.dll","cryptbase.dll","CoreUIComponents.dll","TextShaping.dll","user32.dll","imagehlp.dll","WinTypes.dll","netutils.dll","ntdll.dll","ole32.dll","shlwapi.dll","sspicli.dll","kernel32.dll","cfgmgr32.dll","wintrust.dll","shell32.dll","wow64.dll","msvcrt.dll","msls31.dll","wow64cpu.dll","wldp.dll","gpapi.dll","ws2_32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b","sha256":"58657eb3331e810fd288c23d9845a582f37f18d4d6358dab226a14c9b7d0940b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"VeraCrypt Setup.exe","sha256":"8800efa54e79b2b8be6fd58c5921fc4bc9c81c58ce4bfcf8f336a9c1fae32d45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCrypt Format.exe","sha256":"fc02e001600d4ae4aa4c3f93ba399a2315bc052c9d262be1b6f3bacc00ef1f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCrypt.exe","sha256":"0c70c997f1b85614cebb99e737d9f3d1175f978fe061432f4e043feab626b17b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCryptExpander.exe","sha256":"43485f72bfd0d219e8d69c680ebf72a383054cb4c6544d70ee8657dd959cacbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCrypt User Guide.chm","sha256":"8b5b461d58d601f31ed9540310cac3c00abe471849b4700fda3a0c03556f4ee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCrypt User Guide.ru.chm","sha256":"3f3737f1f93e0c4bbd16b87c764b50034a3ddb82a2abf4400311b7f08ea24a48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"VeraCrypt User Guide.zh-cn.chm","sha256":"66f4ddcc393381479f18282ad403eb61030a7e4bcf92ad391429bb8b1880762b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"veracrypt.cat","sha256":"3c16a5e76bfad0509701da833b894bc94425cd2a948d46862504fd681a47b55a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"veracrypt.inf","sha256":"941a8b7f7962691eba1c419017d059327d5fc7944e7c9fa754ed2d7cdc26cc75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"LICENSE","sha256":"3604a024af5fabc6d5ca73271e199e7f4e0207d36fd4fdd7518684422bed6e28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.ar.xml","sha256":"56fd7a7a8969a296e7f6dabd7041f514d3042fe5074c47f0e9d047c01f714130","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.be.xml","sha256":"1c5a5d2d3fb7805e5cb095f6d34cd90f8a5a1bbd9fb780c2681e3910bba1a205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.bg.xml","sha256":"48eec5cac60ebf34aa4931057f388bbcbe22df8fb57b51110ca451c3c368bc89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.ca.xml","sha256":"00d7f152e2c7415332aa4343051c46c480c6425b81d1bcbf8782fcc13fb7ad11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.co.xml","sha256":"c5f2e7f8d50c52d333d24a635ac156257603772c358135358ab01032d559bead","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.cs.xml","sha256":"74210a1902a73324ec8b6de91d39c3948e06583fadc744b3dfeac1f1e679e44f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.da.xml","sha256":"bcbea674d1a6ab94e812ce3eba6b2ab997052d65ef7d82baba80a6ef97d66cad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.de.xml","sha256":"3c40e0f37e45be3c58c6923c018f71373b010aa16434889c99ffcb8559654d7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.el.xml","sha256":"03e58f3be3aedd197dd8b6f1020cc0f58202bfe6a686182167fbb9612f709d99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.es.xml","sha256":"b4159c6db7ad6ba1a4f2045f7361612ff08e64c15993d4b04cd7ecdf6439b372","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.et.xml","sha256":"a1b39a8ef895cd48b35c553a879fcc8b4e6b4aeb4684b23716ec4a5218884393","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.eu.xml","sha256":"4c1897c66f195c9e3778ed558baa65f7d0118da031b11de114e777b51b7fc622","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.fa.xml","sha256":"2b4d870e4b2cbbd7d322db267f47629f95fc0716f400df6a94352e6791a90734","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.fi.xml","sha256":"3658b9de85f04e4a58fe84ea936b3baad3083d7b132ee94692627b5207967061","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.fr.xml","sha256":"3eeebdff9aa378d633b52cb16a2a88308e8d85b639ca240219304d2429781aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.he.xml","sha256":"1c5c455cea7636acb04d975a4dd990a23aa9a7d27d6ab6535038ce5dc16cd553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.hu.xml","sha256":"d229ad70e01d1b07a1c4e16b1515697f08dcb2b921c57c935791b2ac04f68066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.id.xml","sha256":"b5dc0099b27a6ed22d9353d2d24e5bfdfb65d53a881b8209923a8bf805aa1abe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Language.it.xml","sha256":"b94f59da4b4910fd8854814fc31c2a9f757a1c23f92a92e6c18ed15cdc6cae6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\License.txt","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\NOTICE","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\VeraCrypt.exe","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\VeraCryptExpander.exe","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\VeraCrypt Format.exe","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\veracrypt.inf","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\veracrypt.cat","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\veracrypt.sys","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%WINDIR%\\System32\\drivers\\veracrypt.sys","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\VeraCrypt Setup.exe","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ar.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.be.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.bg.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ca.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.co.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.cs.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.da.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.de.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.el.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.es.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.et.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.eu.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.fa.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.fi.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.fr.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.he.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.hu.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.id.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.it.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ja.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ka.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ko.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.lv.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.my.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.nb.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.nl.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.nn.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.pl.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.pt-br.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ro.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.ru.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.sk.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.sl.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.sv.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.th.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.tr.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.uk.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.uz.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.vi.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.zh-cn.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.zh-hk.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\Languages\\Language.zh-tw.xml","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.chm","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.ru.chm","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\VeraCrypt User Guide.zh-cn.chm","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Acknowledgements.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Additional Security Requirements and Precautions.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\AES.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Android & iOS Support.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Argon2id.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\arrow_right.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Authenticity and Integrity.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Authors.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Avoid Third-Party File Extensions.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\bank_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\BCH_Logo_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\BCH_Logo_48x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\BC_Logo_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_001.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_002.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_003.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_004.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_005.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_007.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_008.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_009.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_010.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_011.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_012.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_013.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_014.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_015.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_016.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_017.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_018.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_019.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_020.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_021.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_022.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_023.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_024.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Beginner's Tutorial_Image_034.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\BLAKE2b-512.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\BLAKE2s-256.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Camellia.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Cascades.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Changing Passwords and Keyfiles.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\chm_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Choosing Passwords and Keyfiles.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Code.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Command Line Usage for Unix.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Command Line Usage for Windows.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Command Line Usage.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineLinux.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelines.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Contact.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Contributed Resources.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Conversion_Guide_VeraCrypt_1.26_and_Later.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Converting TrueCrypt volumes and partitions.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Creating New Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Data Leaks.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Default Mount Parameters.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Default Mount Parameters_VeraCrypt_password_using_default_parameters.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Defragmenting.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Digital Signatures.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Disclaimers.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Documentation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\donation.js","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_CHF.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_Dollars.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_Euros.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_GBP.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_PLN.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_donate_YEN.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VC_BTC_Sigwit.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_Bitcoin.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_BitcoinCash.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_Bitcoin_small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_Ethereum.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_Litecoin.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Donation_VeraCrypt_Monero.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Downloads.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Downloads_1.25.9.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\EFISecureBoot.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\EMV Smart Cards.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\en-flag.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Encryption Algorithms.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Encryption Scheme.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Ethereum_Logo_19x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\FAQ.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Favorite Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-au-small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-au.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-eu-small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-eu.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-gb-small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-gb.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-nz-small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-nz.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-us-small.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flag-us.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\flattr-badge-large.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\freebsd-32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\gf2_mul.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hardware Acceleration.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hash Algorithms.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Header Key Derivation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hibernation File.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hidden Operating System.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hidden Volume.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_canary.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_facebook_veracrypt.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_Finder_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_Linux_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_RaspberryPi_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_reddit.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_tibitDonateButton.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_utilities-file-archiver-3.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_Creating_Volume.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_Default_Mount_Parameters.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_Encrypting_Partition.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_languages_selection.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_menu_Default_Mount_Parameters.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_VeraCrypt_NonSysEncryption.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Home_Windows_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Hot Keys.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\How to Back Up Securely.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Incompatibilities.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\index.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Introduction.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Issues and Limitations.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Journaling File Systems.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Key Derivation Algorithms.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Keyfiles in VeraCrypt.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Keyfiles in VeraCrypt_Image_040.gif","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Keyfiles.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Kuznyechik.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Language Packs.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\language_selection.js","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Legal Information.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\liberapay.svg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\liberapay_donate.svg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\LTC_Logo_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Main Program Window.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Malware.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\mastodon_veracrypt.PNG","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Memory Dump Files.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Miscellaneous.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Modes of Operation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Monero_Logo_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Mounting VeraCrypt Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Multi-User Environment.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\News.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Normal Unmount vs Force Unmount.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Notation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Paging File.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Parallelization.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\paypal_30x30.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\pbkdf2.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\pdf_32x32.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM).html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step1.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step2.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step1.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step2.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step1.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step2.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Physical Security.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Pipelining.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Plausible Deniability.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Portable Mode.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Preface.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Program Menu.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes_Image_027.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes_Image_028.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes_Image_029.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes_Image_030.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Protection of Hidden Volumes_Image_031.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Random Number Generator.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Reallocated Sectors.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\References.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Release Notes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Removable Medium Volume.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Removing Encryption.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\ru-flag.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Security Model.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Security Requirements and Precautions.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Security Requirements for Hidden Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Security Tokens & Smart Cards.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Serpent.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\SHA-256.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\SHA-512.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Sharing over Network.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\SM4.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Source Code.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Standard Compliance.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Streebog.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\styles.css","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Supported Operating Systems.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Supported Systems for System Encryption.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\System Encryption.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\System Favorite Volumes.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Technical Details.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\tib-button.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Trim Operation.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Troubleshooting.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\TrueCrypt Support.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\TrueCrypt Support_truecrypt_mode_gui.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\twitter_veracrypt.PNG","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Twofish.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Unencrypted Data in RAM.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Uninstalling VeraCrypt.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Using VeraCrypt Without Administrator Privileges.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Background Task.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Hidden Operating System.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt License.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Memory Protection.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt RAM Encryption.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Rescue Disk.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt System Files.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Volume Format Specification.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt Volume.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\VeraCrypt128x128.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Volume Clones.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Wear-Leveling.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\Whirlpool.html","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\zh-cn-flag.png","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\AddNewSystemVar.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\CertificateCannotBeVerified.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\CertVerifyFails.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\DistributionPackageDamaged.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\DownloadVS2010.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\DownloadVS2019.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\DownloadVSBuildTools.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\gzipCommandLine.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\NasmCommandLine.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\RegeditPermissions-1.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\RegeditPermissions-2.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\RegeditPermissions-3.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\RegeditPermissions-4.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\SelectAdvancedSystemSettings.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\SelectEnvironmentVariables.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"path":"%PROGRAMFILES%\\VeraCrypt\\docs\\html\\zh-cn\\CompilingGuidelineWin\\SelectPathVariable.jpg","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Local\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"Local\\SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]},{"name":"\\BaseNamedObjects\\VeraCrypt Setup","sources":[{"report_type":"sandbox","report_id":"6af1640549c2e89b1506b6c0"}]}]}},"report_ids":{"sandbox_job_ids":["6af1640549c2e89b1506b6c0"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Suspicious:Packed.Krap.ao.qjxi Sample 9d7b4c294a35… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9d7b4c294a35…. Malware family: Suspicious:Packed.Krap.ao.qjxi. Threat score 80/100. 1/27 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615"}],["$","meta","4",{"property":"og:title","content":"Malicious Suspicious:Packed.Krap.ao.qjxi Sample 9d7b4c294a35… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9d7b4c294a35…. Malware family: Suspicious:Packed.Krap.ao.qjxi. Threat score 80/100. 1/27 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9d7b4c294a353efd45855205133286c04f07308218877f29ee881f686268a615"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Suspicious:Packed.Krap.ao.qjxi Sample 9d7b4c294a35… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9d7b4c294a35…. Malware family: Suspicious:Packed.Krap.ao.qjxi. Threat score 80/100. 1/27 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]] 32:null