23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T7ad,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")25:T86d,"msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")26:Ta41,"msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 131072) "msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 65536) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 33289985) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 513) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 33290241) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 3483137) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 33290241) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 33290241) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 769) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 33290241) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 33290241) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 3480065) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 33290241)27:T66d,Pattern match: "http://go.microsoft.com/fwlink/?LinkId=52156ARPHELPLINKSecureCustomPropertiesUpgradeVersionMinVersionMaxRemoveActionPropertyThe" Pattern match: "http://usetermassembly/dealbuilder_live/DealBuilderNET/dealbuilder.aspx}{\propname" Pattern match: "http://usetermassembly/dealbuilder_live/DealBuilderNET/dealbuilder.aspx" Pattern match: "http://www.microsoft.com/licensing/userights" Pattern match: "www.microsoft.com/licensing/userights}}}{\b0\insrsid6585109\charrsid8681546" Pattern match: "http://www.microsoft.com/exporting" Pattern match: "ft.com/exporting}}}{\cs61\b0\ul\cf2\insrsid9964378\charrsid14425952" Heuristic match: "ature will be set to be installed when required.SelAbsentAdvertiseSelAbsentCDThis feature will be installed on the local hard drive.SelAbsentLocalThis feature will be installed to run from the network.SelAbsentNetworkThis feature will become unavailable.Se" Heuristic match: "es up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostNegPosThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on you" Pattern match: "http://ocsp.verisign.com0" Pattern match: "crl.verisign.com/ThawteTimestampingCA.crl0" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0" Pattern match: "http://msdn.microsoft.com" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl"28:T8c5,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")29:T727,"msiexec.exe" wrote bytes "48b8101698f5fe070000ffe0" to virtual address "0xFCC11000" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "48b8601398f5fe070000ffe0" to virtual address "0xFCC11340" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "301298f5fe070000" to virtual address "0xF8712050" (part of module "WEBIO.DLL") "msiexec.exe" wrote bytes "00100000" to virtual address "0xFCC285A4" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00100000" to virtual address "0xFCC28468" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "4013c1fcfe070000" to virtual address "0xFCC2FE48" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "4013c1fcfe070000" to virtual address "0xFCC2FB48" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "4013c1fcfe070000" to virtual address "0xFCC2FE10" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "0010c1fcfe070000" to virtual address "0xFCC2FE50" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "4013c1fcfe070000" to virtual address "0xFCC2FB10" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "0010c1fcfe070000" to virtual address "0xFCC2FB50" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00100000" to virtual address "0xFEDC1748" (part of module "WS2_32.DLL") "msiexec.exe" wrote bytes "48b8e01198f5fe070000ffe0" to virtual address "0xFED91000" (part of module "WS2_32.DLL") "msiexec.exe" wrote bytes "40130000" to virtual address "0xFCC28538" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "40130000" to virtual address "0xFCC28478" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "0010c1fcfe070000" to virtual address "0xFCC2FE18" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "0010c1fcfe070000" to virtual address "0xFCC2FB18" (part of module "SSPICLI.DLL")2a:T501,"727E0986F857F6_A743_463D_B2FE_98CB5F727E09WdSfpCaMainModId.41646F16_4E6C_4E96_BF1B_772105414B9DWdsfpca_Uninstall_RegKey.86F857F6_A743_463D_B2FE_98CB5F727E09AppGuidRegKeywdsfpca.86F857F6_A743_463D_B2FE_98CB5F727E09Wdsfpca_AddRefcountMsxmlWdsfpca_ReleaseRefcountMsxml{11111111-1111-1111-1111-111111111111}SOFTWARE\Microsoft\MSXML60\SetupPatchLevelSOFTWARE\Microsoft\MSXML 6.0 Parser and SDK\CurrentVersion6.0RegVersionCLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\SideBySideRgsImportKey_5.86F857F6_A743_463D_B2FE_98CB5F727E09[#msxml6.dll.86F857F6_A743_463D_B2FE_98CB5F727E09]CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\VersionListRgsImportKey_4.86F857F6_A743_463D_B2FE_98CB5F727E09XML DOM DocumentCLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}RgsImportKey_3.86F857F6_A743_463D_B2FE_98CB5F727E09*Msxml2.DOMDocument.6.0RgsImportKey_6.86F857F6_A743_463D_B2FE_98CB5F727E09XML DOM Document 6.0RgsImportKey_7.86F857F6_A743_463D_B2FE_98CB5F727E09Msxml2.DOMDocument.6.0\CLSIDRgsImportKey_8.86F857F6_A743_463D_B2FE_98CB5F727E09{88d96a05-" "Software\Microsoft\Microsoft SQL Server\90" "Software\Microsoft\Microsoft SQL Server\90\Bootstrap" "Software\Microsoft\Windows\CurrentVersion\Installer" "SYSTEM\CurrentControlSet\Control\Session Manager" "SOFTWARE\Microsoft\NET Framework Setup\NDP"2b:T4e1f,"NameTableTypePropertyValue_ValidationColumnNullableMinValueMaxValueKeyTableKeyColumnCategorySetDescriptionName of tableIdentifierNName of columnDescription of columnTextYSet of values that are permittedString categoryText;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;KeyFormatted;CustomSource;Property;Cabinet;Shortcut;URLColumn to which foreign key connectsFor foreign key, Name of table to which data must linkMaximum value allowedMinimum value allowedWhether the column is nullableY;N;@Name of property, uppercase if settable by launcher or loader.String value for property. Never null or empty.ProductCodeMicrosoft CorporationManufacturerProductVersion1033ProductLanguage{5BBED1F8-E6F3-4A02-BC97-26D35BE200CA}UpgradeCodeFileComponent_FileNameFileSizeVersionLanguageAttributesSequenceSequence with respect to the media images; order must track cabinet order.Integer containing bit flags representing file attributes (with t" (Indicator: "connect") "comeDlgSetupProgressDlgExecuteActionWOWFLAG And INSTALLSQLSHAREDDIR >> "\"(INSTALLSQLSHAREDDIR AND (INSTALLSQLSHAREDDIR <> "")) AND WOWFLAG And Not UI_INSTALLSQLSHAREDDIR And (Not INSTALLSQLSHAREDDIR ~>< "x86") And (Not INSTALLSQLSHAREDDIR ~<< ProgramFiles64Folder ) And Not APPENDCUSTOMPATHFLAG(INSTALLSQLSHAREDDIR AND (INSTALLSQLSHAREDDIR <> "")) AND WOWFLAG And Not UI_INSTALLSQLSHAREDDIR And (Not INSTALLSQLSHAREDDIR ~>< "x86") And (Not INSTALLSQLSHAREDDIR ~<< ProgramFiles64Folder ) And APPENDCUSTOMPATHFLAGSetODBCFoldersInstallValidateInstallInitializeAllocateRegistrySpaceProcessComponentsUnpublishComponentsMsiUnpublishAssembliesUnpublishFeaturesVersionNTStopServicesDeleteServicesUnregisterComPlusSelfUnregModulesUnregisterTypeLibrariesUnregisterFontsRemoveRegistryValuesUnregisterClassInfoUnregisterExtensionInfoUnregisterProgIdInfoUnregisterMIMEInfoRemoveIniValuesRemoveShortcutsRemoveEnvironmentStringsRemoveDuplicateFilesRemoveFilesRemoveFoldersCreateFoldersMoveFilesInstallFilesPatchFilesDuplicateFilesBindImag" (Indicator: "DeleteService") "nly when the ComponentId column is an Qualified Component Id. This is the Qualifier for ProvideComponentIndirect.LevelExpression evaluated to determine if Level in the Feature table is to change.Reference to a Feature entry in Feature table.New selection Level to set in Feature table if Condition evaluates to TRUE.ServiceControlEventArgumentsWaitName of a service. /, \, comma and space are invalidRequired foreign key into the Component Table that controls the startup of the serviceBit field: Install: 0x1 = Start, 0x2 = Stop, 0x8 = Delete, Uninstall: 0x10 = Start, 0x20 = Stop, 0x80 = DeletePrimary key, non-localized token.Arguments for the service. Separate by [~].Boolean for whether to wait for the service to fully startModuleDependencyModuleIDModuleLanguageRequiredIDRequiredLanguageRequiredVersionModule requiring the dependency.ModuleSignatureLanguage of module requiring the dependency.String.GUID of required module.LanguageID of the required module.Version of the required version.ModuleExclusionExcludedI" (Indicator: "select") "error [2].}} Verify that the file exists and that you can access it.Error writing to file: [3]. {{ System error [2].}} Verify that you have access to that directory.Source file not found{{(cabinet)}}: [2]. Verify that the file exists and that you can access it.Cannot create the directory '[2]'. A file with this name already exists. Please rename or remove the file and click retry, or click Cancel to exit.The volume [2] is currently unavailable. Please select another.The specified path '[2]' is unavailable.Unable to write to the specified folder: [2].A network error occurred while attempting to read from the file: [2]An error occurred while attempting to create the directory: [2]A network error occurred while attempting to create the directory: [2]A network error occurred while attempting to open the source file cabinet: [2]The specified path is too long: [2]The Installer has insufficient privileges to modify this file: [2].A portion of the folder path '[2]' is invalid. It is either empty or exceeds th" (Indicator: "open") "e length allowed by the system.The folder path '[2]' contains words that are not valid in folder paths.The folder path '[2]' contains an invalid character.'[2]' is not a valid short file name.Error getting file security: [3] GetLastError: [2]Invalid Drive: [2]Error applying patch to file [2]. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. {{System Error: [3]}}A file that is required cannot be installed because the cabinet file [2] is not digitally signed. This may indicate that the cabinet file is corrupt.A file that is required cannot be installed because the cabinet file [2] has an invalid digital signature. This may indicate that the cabinet file is corrupt.{{ Error [3] was returned by WinVerifyTrust.}}Failed to correctly copy [2] file: CRC error.Failed to correctly move [2] file: CRC error.Failed to correctly patch [2] file: CRC error.The file '[2]' cannot be installed because the file cannot be found in cabin" (Indicator: "GetLastError") "et file '[3]'. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package.The cabinet file '[2]' required for this installation is corrupt and cannot be used. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package.There was an error creating a temporary file that is needed to complete this installation.{{ Folder: [3]. System error code: [2]}}Could not create key: [2]. {{ System error [3].}} Verify that you have sufficient access to that key, or contact your support personnel.Could not open key: [2]. {{ System error [3].}} Verify that you have sufficient access to that key, or contact your support personnel.Could not delete value [2] from key [3]. {{ System error [4].}} Verify that you have sufficient access to that key, or contact your support personnel.Could not delete key [2]. {{ System error [3].}} Verify that you have sufficient access to that key, or contact your support personnel.Could not read value [2] from" (Indicator: "open") "Retry to check for available space again, or click Cancel to quit the installation.Could not access network location [2].The following applications should be closed before continuing the install:Could not find any previously installed compliant products on the machine for installing this product.An error occurred while applying security settings. [2] is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. {{Unable to locate the user's SID, system error [3]}}The key [2] is not valid. Verify that you entered the correct key.The installer must restart your system before configuration of [2] can continue. Click Yes to restart now or No if you plan to manually restart later.You must restart your system for the configuration changes made to [2] to take effect. Click Yes to restart now or No if you plan to manually restart later.An installation for [2] is curre" (Indicator: "connect") "dor. {{Action [2], location: [3], command: [4] }}There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. {{Action [2], entry: [3], library: [4] }}Removal completed successfully.Removal failed.Advertisement completed successfully.Advertisement failed.Configuration completed successfully.Configuration failed.You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.The path [2] is not valid. Please specify a valid path.There is no disk in drive [2]. Please insert one and click Retry, or click Cancel to go back to the previously selected volume.There is no disk in drive [2]. Please insert one and click Retry, or click Cancel to return to the browse dialog and select a different volume.The folder [2] does not exist. Please enter a path to an existing folder.You have insufficient priv" (Indicator: "select") "onfigured by the UI. A non-null value will enable the browse button.The install level at which record will be initially selected. An install level of 0 will disable an item and prevent its display.Short text identifying a visible feature item.Numeric sort order, used to force a specific display ordering.Optional key of a parent record in the same table. If the parent is not selected, then the record will not be installed. Null indicates a root item.Microsoft XML ParserMSXMLSYSMediaDiskIdLastSequenceCabinetVolumeLabelThe property defining the location of the cabinet file.If some or all of the files stored on the media are compressed in a cabinet, the name of that cabinet.Primary key, integer to determine sort order for table.Disk name: the visible text actually printed on the disk. This will be used to prompt the user when this disk needs to be inserted.File sequence number for the last file for this media.The label attributed to the volume.#XML_Core.cabDirectory_ParentDefaultDirUnique identifier for director" (Indicator: "select") "nstallModeReturnEndDialog[ButtonText_Update_Hot][DialogPatchTitle]RESUMEDlgDescPreselectedSetupResumeDlgNOT RESUMEThe Install Wizard will complete the installation of [ShortName] on your computer. To continue, click Next.DlgDescResumeThe Install Wizard will complete the suspended installation of [ShortName] on your computer. To continue, click Next.[DlgTitleStyleB]Resuming the Install Wizard for [ShortName]OutOfNoRbDiskSpace = 1DiskSpaceInsufficientDlgOutOfNoRbDiskSpace <> 1ISENABLEDWUSFINISHDIALOG And NOT Installed And ACTION="INSTALL"DlgDescInstallSuccessSetup has installed [ShortName] successfully. Click Finish to exit.ISENABLEDWUSFINISHDIALOG And Installed And ((_IsMaintenance="Remove" AND EnableFeatureDlg<>1) OR (_IsMaintenance2="Remove" AND EnableFeatureDlg=1))DlgDescRemoveSuccessSetup has removed [ShortName] successfully. Click Finish to exit.ISENABLEDWUSFINISHDIALOG And Installed And ((_IsMaintenance="Modify" AND EnableFeatureDlg<>1) OR (_IsMaintenance2="Modify" AND EnableFeatureDlg=1))DlgDescModifySu" (Indicator: "select") "NAME="db_input_show_committed" TYPE="boolean">fa lsetrue2dropdownsureUnknownfirstOtherlast20204true falseclient_side<\'3bU>\'3bWARNING:<\'3b/U>\'3b That page is no longer relevant because of answers given on this page or a previous page!enabledrelevant_pages01< Variable NAME="DistributableCode" TYPE="boolean" STATUS="sure">1Redis" (Indicator: "select"), "t.txt10English 000Any number of copies00XML Core Services (MSXML) 6.00Free Sta ndalone SoftwareOn the user&apos\'3bs device(s)0Transfer to a third party1}}{\*\ftnsep \pard\plain \ql \li0\ri0\sb120\sa120\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs19\lang1033\langfe1033\loch\af37\hich\af37\dbch\af11\cgrid\langnp1033\langfenp1033 {\insrsid14425952 \chftnsep \par }}{\*\ftnsepc \pard\plain \ql \li0\ri0\sb120\sa120\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs19\lang1033\langfe1033\loch\af37\hich\af37\dbch\af11\cgrid\langnp1033\langfenp1033 {\insrsid14425952 \chftnsepc \par }}{\*\aftnsep \pard\p" (Indicator: "select"), "as modified DescText_SuccessfulModifyDescText_SuccessfulModify2Setup was interrupted before DescText_SetupInterrupted could be completely installed.DescText_SetupInterrupted2 Setup is preparing the Install Wizard which will guide you through the program setup process. Please wait.DescText_PreparingSetupSelect the program features you want installed.DescText_FeatureSelectionThe program features you selected are being installed.DescText_ProgramFeaturesInstallThe program features you selected are being uninstalled.DescText_ProgramFeaturesUninstallPlease read the following license agreement carefully.DescText_ReadLicenseSpecify a network location for the server image of the product.DescText_SpecifyNetworkLocationBrowse to the destination folder.DescText_BrowseDestinationRepair or remove the program.DescText_ModifyRepairRemoveSetup is ready to begin installation.DescText_ReadyInstallationYou have chosen to remove the program from your system.DescText_ChosenRemoveThe disk space required for the installation of the" (Indicator: "select"), "selected features.DescText_DiskSpaceRequirementsDisk space required for the installation exceeds available disk space.DescText_DiskExceedsAvailableYour system has not been modified. To complete installation at another time please run setup again.Text_ReRunSetupClick Finish to exit Setup.Text_FinishExitYou can either keep any existing installed elements on your system to continue this installation at a later time or you can restore your system to its original state prior to the installation.Text_RestoreStateClick Restore or Continue Later to exit Setup.Text_RestoreClickPlease wait while the Install Wizard installs Text_InstallWait. This may take several minutes.Text_InstallWait2Please wait while the Install Wizard uninstalls Text_UninstallWaitTextText_UninstallWaitText2Text_UninstallWaitText_UninstallWait2Progress doneText_ProgressDoneWARNING: This program is protected by copyright law and international treaties.Text_CopyrightClick Install to begin the installation.Text_BeginInstallationIf you want to review" (Indicator: "select"), "or change any of your installation settings click Back. Click Cancel to exit Setup.Text_ReviewChangeClick an icon in the following list to change how a feature is installed.Text_AlterFeatureInstallThe installation is not yet complete. Are you sure you want to exit?Text_ConfirmExitThis feature requires 4 MB on your hard drive.Text_FeatureSelectionDescriptionEnter the network location or click Change to browse to a location. Click Install to create a server image of Text_EnterNetworkLocation at the specified network location or click Cancel to exit Setup.Text_EnterNetworkLocation2The highlighted volumes do not have enough disk space available for the currently selected features. You can remove files from the highlighted volumes choose to install less features onto local drives or select different destination drives.Text_SelectDifferentDriveRepair installation errors in the program. This option fixes missing or corrupt files shortcuts and registry entries.Text_RepairInstallationErrorsRemove Text_RemoveFromC" (Indicator: "select"), "lCostPendingThis feature will be completely removed.SelLocalAbsentThis feature will be removed from your local hard drive but will be set to be installed when required.SelLocalAdvertiseThis feature will be removed from your local hard drive but will still be available to run from CD.SelLocalCDThis feature will remain on your local hard drive.SelLocalLocalThis feature will be removed from your local hard drive but will be still available to run from the network.SelLocalNetworkThis feature will be uninstalled completely and you will not be able to run it from the network.SelNetworkAbsentThis feature was run from the network but will be installed when required.SelNetworkAdvertiseThis feature was run from the network but will be installed on the local hard drive.SelNetworkLocalThis feature will continue to be run from the networkSelNetworkNetworkThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostNegNegThis feature fre" (Indicator: "select"), "es up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostNegPosThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostPosNegThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostPosPosTime remaining: {[1] min }[2] secTimeRemainingAvailableVolumeCostAvailableDifferencesVolumeCostDifferenceRequiredVolumeCostRequiredDisk SizeVolumeCostSizeVolumeVolumeCostVolumeThis computer must have at least Windows 2000 SP4 and the user must have administrator privileges in order to install [ProductName].[ProductName] requires the .NET Framework version 2.0. Ensure that this requirement is fulfilled before installing [ProductName].A previous installation required a reboot of the machine for changes to take effect. To proceed restart your computer and then run Setup again.In" (Indicator: "select"), "CorExitProcess" (Indicator: "ExitProcess")2c:T7a2,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.LOCAL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77FBC64BA73370EC2F659BAD977FF2AD_5532ADAD31742BEC61EECE01C839F873" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\webio.dll" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21EA03E12A6F9D076B6BC3318EA9363E_FB4F1E022CC2E2F375B3F847CC606B14" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21EA03E12A6F9D076B6BC3318EA9363E_FF16612C97C4BF706746B479DD465F8C" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\af-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\am-ET\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ar-SA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\as-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\az-Latn-AZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\be-BY\SXS.DLL.MUI"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Clean Sample 9e55c254d48e… — Score 0/100 — Hybrid Analysis\",\"description\":\"Clean verdict for sample 9e55c254d48e…. Threat score 0/100. 0/26 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9\",\"keywords\":[\"Clean\",\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"msxml6_x64.msi.rtf\",\"applicationCategory\":[\"rtf\"],\"identifier\":\"9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9\",\"additionalType\":\"Clean sample\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":26},\"behavioralIndicators\":{\"malicious\":2,\"suspicious\":11},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1790335110614,"unified_at":"2026-09-25T11:18:30.614Z","metadata":{"hashes":{"sha256":"9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9","sha1":"1eb84eeae7729ea5db7fe79779f4e216114261ba","md5":"109c400eae269ec1c8761589b81884a0","sha512":"5f2925357d5bfecb5dae3ba6366862f21da119c06d3059ac64cca4b3abbd510e6691da28d358b6a4231f0c43de491efbbd4d5890f7c59c0216a42f45e41e7725","ssdeep":"49152:7H4r0IV/EuRRPLQp456IjYEy3OOWqiwoGipm+YUHoD:RuTLQwj7y3OiBoGEmlgo","ssdeep_chunks":["49152:7H4r0IV","49152:H4r0IV/","49152:4r0IV/E","49152:r0IV/Eu","49152:0IV/EuR","49152:IV/EuRR","49152:V/EuRRP","49152:/EuRRPL","49152:EuRRPLQ","49152:uRRPLQp","49152:RRPLQp4","49152:RPLQp45","49152:PLQp456","49152:LQp456I","49152:Qp456Ij","49152:p456IjY","49152:456IjYE","49152:56IjYEy","49152:6IjYEy3","49152:IjYEy3O","49152:jYEy3OO","49152:YEy3OOW","49152:Ey3OOWq","49152:y3OOWqi","49152:3OOWqiw","49152:OOWqiwo","49152:OWqiwoG","49152:WqiwoGi","49152:qiwoGip","49152:iwoGipm","49152:woGipm+","49152:oGipm+Y","49152:Gipm+YU","49152:ipm+YUH","49152:pm+YUHo","49152:m+YUHoD","98304:7H4r0IV","98304:H4r0IV/","98304:4r0IV/E","98304:r0IV/Eu","98304:0IV/EuR","98304:IV/EuRR","98304:V/EuRRP","98304:/EuRRPL","98304:EuRRPLQ","98304:uRRPLQp","98304:RRPLQp4","98304:RPLQp45","98304:PLQp456","98304:LQp456I","98304:Qp456Ij","98304:p456IjY","98304:456IjYE","98304:56IjYEy","98304:6IjYEy3","98304:IjYEy3O","98304:jYEy3OO","98304:YEy3OOW","98304:Ey3OOWq","98304:y3OOWqi","98304:3OOWqiw","98304:OOWqiwo","98304:OWqiwoG","98304:WqiwoGi","98304:qiwoGip","98304:iwoGipm","98304:woGipm+","98304:oGipm+Y","98304:Gipm+YU","98304:ipm+YUH","98304:pm+YUHo","98304:m+YUHoD","49152:RuTLQwj","49152:uTLQwj7","49152:TLQwj7y","49152:LQwj7y3","49152:Qwj7y3O","49152:wj7y3Oi","49152:j7y3OiB","49152:7y3OiBo","49152:y3OiBoG","49152:3OiBoGE","49152:OiBoGEm","49152:iBoGEml","49152:BoGEmlg","49152:oGEmlgo"],"imphash":"Unknown"},"file_info":{"file_name":"msxml6_x64.msi.rtf","file_type":["rtf"],"file_type_id":"rtf","file_size":2721280,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510910371000,"last_seen":1768794152000,"last_multi_scan":1768794152000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["adware","kraddare"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":54,"suspicious_count":11,"malicious_count":2,"total":67},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"New Service","attack_id":"T1050","attack_id_wiki":"https://attack.mitre.org/techniques/T1050","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found a string that may be used as part of an injection method"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Tries to access unusual system drive letters"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\32BC95FF008174044BC02EA07E504119\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00064622-00003320-00000046-1673317\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00065180-00002684-00000046-13932586063239266","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00064622-00003320-00000046-1673317\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00065180-00002684-00000046-13932586063239266","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/58 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$24","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"sqlmsirc.pdb\"\n \"wdsfpca.pdb\"\n \"redistca.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"msiexec.exe\" created file \"%TEMP%\\MSI9503.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute\"\n \"Global\\_MSIExecute\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MSI9503.tmp\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"msiexec.exe\" touched \"Msi install server\" (Path: \"HKCU\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{000C103E-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00065180-00002684) was launched with modified environment variables: \"CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00065180-00002684) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"msiexec.exe\" (UID: 00065361-00000108) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\wEFt6iA\", HOMEDRIVE=\"C:\"\"\n Process \"msiexec.exe\" (UID: 00065361-00000108) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00065180-00002684)\n Spawned process \"msiexec.exe\" with commandline \"-Embedding E176126EF5852027A1DBA83C34DB009F C\" (UID: 00065361-00000108)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00065180-00002684)\n Spawned process \"msiexec.exe\" with commandline \"-Embedding E176126EF5852027A1DBA83C34DB009F C\" (UID: 00065361-00000108)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation\" (SHA1: A2:58:00:BB:75:77:F5:85:4B:38:23:B8:22:28:D9:41:40:D0:24:4E: (sha1RSA(RSA)); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=Copyright c 2000 Microsoft Corp., CN=Microsoft Code Signing PCA\" (SHA1: B0:4E:DD:83:D6:79:F4:08:1B:C1:D2:BD:BC:5F:6B:3B:E5:C6:4C:3E: (md5RSA(RSA)); see report for more information)\n The input sample is signed with a certificate issued by \"OU=Copyright c 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority\" (SHA1: A4:34:89:15:9A:52:0F:0D:93:D0:32:CC:AF:37:E7:FE:20:A8:B4:19: (md5RSA(RSA)); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4781 bytes 1 file\"\n \"E6024EAC88E6B6165D49FE3C95ADD735\" has type \"data\"\n \"MSI9503.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$26","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"msiexec.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"msiexec.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\msiexec.exe\"\n \"msiexec.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\AcLayers.dll\"\n \"msiexec.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\AcGenral.dll\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\en-US\\msiexec.exe.mui\"\n \"msiexec.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\msimsg.dll\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\en-US\\msimsg.dll.mui\"\n \"msiexec.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"msiexec.exe\" touched file \"%WINDIR%\\AppPatch\\msimain.sdb\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\sxs.dll\"\n \"msiexec.exe\" touched file \"%WINDIR%\\System32\\en-US\\sxs.dll.mui\"\n \"msiexec.exe\" touched file \"%WINDIR%\\system32\\de-DE\\sxs.DLL.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\System32\\msiexec.exe\" marked \"%TEMP%\\MSI9503.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"%TEMP%\\MSI9503.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4781 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"msiexec.exe\" at 00064622-00003320-00000033-1269465\n \"msiexec.exe\" at 00065180-00002684-00000033-1849383\n \"msiexec.exe\" at 00065361-00000108-00000033-1918832","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/80 reputation engines marked \"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"msiexec.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\msiexec.exe\", Handle: )","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI9503.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"msiexec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"\n \"msiexec.exe\" touched \"R:\"\n \"msiexec.exe\" touched \"S:\"\n \"msiexec.exe\" touched \"T:\"\n \"msiexec.exe\" touched \"U:\"\n \"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"msiexec.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 428)\n \"msiexec.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 428)\n \"msiexec.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 428)\n \"msiexec.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 428)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 6C990000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"msiexec.exe\" called \"LoadResource\" (UID: 00000000-00004496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00004496)\n \"msiexec.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00004496)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetSystemDefaultUILanguage\"[Source: 9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9.msi.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9.msi.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$2b","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\msiexec.exe\" [Source: 00000000-00006844-00000BC0-100820165]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"msiexec.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00004496)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00004496)\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004496)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"msiexec.exe\" called \"FindFirstFileW\" (UID: 00000000-00004496)\n \"msiexec.exe\" called \"FindNextFileW\" (UID: 00000000-00004496)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9.msi.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"MSI280D.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\MSI280D.tmp]- [targetUID: 00000000-00003148]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"msiexec.exe\" queried SystemProcessInformation at 00000000-00004496-00000036-1550815\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00004496-00000036-1557979\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00004496-00000036-3546923\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00004496-00000036-3548605\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00006844-00000036-1009851\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00006844-00000036-1011118\n \"MsiExec.exe\" queried SystemProcessInformation at 00000000-00003148-00000036-1247417\n \"MsiExec.exe\" queried SystemProcessInformation at 00000000-00003148-00000036-1248735","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\"\n \"MsiExec.exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI280D.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\MSI280D.tmp]- [targetUID: 00000000-00003148]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"2/70 Antivirus vendors marked spawned process \"msiexec.exe\" (PID: 6844) as malicious (classified as \"Virus.Expiro\" with 2% detection rate)\n 2/70 Antivirus vendors marked spawned process \"MsiExec.exe\" (PID: 3148) as malicious (classified as \"Virus.Expiro\" with 2% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":145,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":139,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adware","kraddare"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"63c8d5f29f439869f121e6c6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"clean","submit_name":"msxml6_x64.msi","analysis_start_time":"2023-01-19T05:32:36+00:00","indicators_count":{"informative":42,"suspicious":5,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5f737a42c73df25eca147caf","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","submit_name":"msxml6_x64.msi","analysis_start_time":"2020-09-29T18:17:46+00:00","indicators_count":{"informative":34,"suspicious":8,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5a0ea6e786fe16cf2d0ea722","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"msxml6_x64.msi.rtf","analysis_start_time":"2017-11-17T10:07:51+00:00","indicators_count":{"informative":17,"suspicious":0,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}],"processes":[{"pid":3320,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\msxml6_x64.msi\"","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00064622-00003320","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABvElEQVR42rWWwZHDIAxFubkfCsrNLeS8p5SQGW45bAWuIAXo7gJSCPH37mcVViRgY8388YyN/R8SAju3Mc7nc9wjtycul0vcGvf7PeL9LgDOfTXpEIBRYpJf7i2XdHXx79nhALm51+ZBjgX4aH4kQJX5kQBV5nsAMDgX7lsZKJn7ceMitPq9lIF35psAMOh0Or3I3AcqzJsBSubft1vsvhFZNaZy8xyg21Zc+mBurgHwoa0yS5Cn3DInQI+YpikOwxA/tpsF8K5sNYJ5VRlKAHx+vV5fxLO+JnYB0GiUsIwKUWRMwuy896us2RfXQS0A1oZfenwMoQgAYSwg8trDvLkEeJbMRVYAQgBAQ9AcghkgrE5o2nYJkQBEzCzo2cMEYWWhad/X5o/HA1b/IUJ4mT3N53leVQVBABFJV50BAhBCg+jexliaMyPVANrcykBYZpor/w5nrVd+twzgHsXZvft/6J4BbUzpFc0SQXpMtwxY5iJhlUNJlnWhIaguGeAOqM0JgDb8+QkJaYE2mX/KgD4xtbkGWLshg1g7pQXAyoB1bGtzAshvW2qIavPW4P9CCYCHkTs69M8LTVuNn8o4YS+PakCyAAAAAElFTkSuQmCC"},{"pid":2684,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00065180-00002684","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABvElEQVR42rWWwZHDIAxFubkfCsrNLeS8p5SQGW45bAWuIAXo7gJSCPH37mcVViRgY8388YyN/R8SAju3Mc7nc9wjtycul0vcGvf7PeL9LgDOfTXpEIBRYpJf7i2XdHXx79nhALm51+ZBjgX4aH4kQJX5kQBV5nsAMDgX7lsZKJn7ceMitPq9lIF35psAMOh0Or3I3AcqzJsBSubft1vsvhFZNaZy8xyg21Zc+mBurgHwoa0yS5Cn3DInQI+YpikOwxA/tpsF8K5sNYJ5VRlKAHx+vV5fxLO+JnYB0GiUsIwKUWRMwuy896us2RfXQS0A1oZfenwMoQgAYSwg8trDvLkEeJbMRVYAQgBAQ9AcghkgrE5o2nYJkQBEzCzo2cMEYWWhad/X5o/HA1b/IUJ4mT3N53leVQVBABFJV50BAhBCg+jexliaMyPVANrcykBYZpor/w5nrVd+twzgHsXZvft/6J4BbUzpFc0SQXpMtwxY5iJhlUNJlnWhIaguGeAOqM0JgDb8+QkJaYE2mX/KgD4xtbkGWLshg1g7pQXAyoB1bGtzAshvW2qIavPW4P9CCYCHkTs69M8LTVuNn8o4YS+PakCyAAAAAElFTkSuQmCC"},{"pid":108,"ppid":2684,"name":"msiexec.exe","command_line":"-Embedding E176126EF5852027A1DBA83C34DB009F C","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00065180-00002684","uid":"00065361-00000108"}],"all_imported_dlls":["clbcatq.dll","Wldap32.dll","api-ms-win-core-synch-l1-2-0.dll","ntdll.dll","sfc.dll","netutils.dll","sxs.dll","gdi32.dll","oleaut32.dll","shell32.dll","propsys.dll","srvcli.dll","WSHTCPIP.DLL","msi.dll","dnsapi.dll","AcLayers.dll","msctf.dll","bcryptprimitives.dll","VxSSL64.dll","mscoree.dll","cfgmgr32.dll","msvcrt.dll","wship6.dll","IPHLPAPI.DLL","winhttp.dll","sfc_os.dll","userenv.dll","user32.dll","FWPUCLNT.DLL","AcGenral.dll","dwmapi.dll","bcrypt.dll","credssp.dll","msihnd.dll","rpcrt4.dll","lpk.dll","dhcpcsvc.dll","imm32.dll","msimsg.dll","cryptnet.dll","ole32.dll","shlwapi.dll","apphelp.dll","msisip.dll","nsi.dll","mswsock.dll","kernel32.dll","uxtheme.dll","netapi32.dll","wintrust.dll","RpcRtRemote.dll","clr.dll","rasadhlp.dll","rpcss.dll","webio.dll","advapi32.dll","mscoreei.dll","mpr.dll","cryptsp.dll","rsaenh.dll","cryptbase.dll","wkscli.dll","crypt32.dll","gpapi.dll","fusion.dll","comdlg32.dll","sechost.dll","profapi.dll","KernelBase.dll","msasn1.dll","version.dll","usp10.dll","dhcpcsvc6.dll","comctl32.dll","ncrypt.dll","sspicli.dll","SensApi.dll","ws2_32.dll","winnsi.dll","MSOINTL.DLL","MSGR3EN.DLL","MSCONV97.DLL","unidrvui.dll","msvcp90.dll","NL7MODELS0009.dll","mlang.dll","RICHED20.DLL","slc.dll","devobj.dll","linkinfo.dll","vfprint.dll","mxdwdrv.dll","CSS7DATA0009.DLL","msvcr90.dll","msxml6.dll","OART.DLL","MSO.DLL","WWLIB.DLL","cscapi.dll","mscss7en.dll","MSORES.DLL","msxml6r.dll","WinSCard.dll","wtsapi32.dll","USP10.DLL","ntshrui.dll","msimg32.dll","powrprof.dll","msproof7.dll","GdiPlus.dll","ALRTINTL.DLL","ntmarta.dll","imageres.dll","WWINTL.DLL","MSPTLS.DLL","OSPPC.DLL","setupapi.dll","urlmon.dll","wininet.dll","iertutil.dll","OSPPCEXT.DLL","SendToOneNoteUI.dll","fontsub.dll","MSSP7EN.DLL","GFX.DLL","kernel.appcore.dll","pcacli.dll","fltLib.dll","ucrtbase.dll","windows.storage.dll","CoreUIComponents.dll","SHCore.dll","coml2.dll","OnDemandConnRouteHelper.dll","srpapi.dll","WindowsCodecs.dll","msvcp_win.dll","wldp.dll","winnlsres.dll","gdi32full.dll","win32u.dll","combase.dll","WinTypes.dll","TextInputFramework.dll","CoreMessaging.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSI9503.tmp","sha256":"251e9aa1f3446151f0d40fd39f20b797b8af73efe243a4b27950250dbf5aab18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"d72cf15c48b4c593cd3f6cce221973129bd0a94867d948b4f984f39009533362","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"name":"E6024EAC88E6B6165D49FE3C95ADD735","sha256":"e325c69dd035d7cb5f62184fc50d5dd85434bb68050fe5a4c0286bd6f21d52dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"name":"index.dat","sha256":"2b9ca6b2cb6c0384b0fd7f0e7e02b376fe7eeac3eaa5920729921aea7257b4f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"msxml6_x64.msi.LNK","sha256":"b386bc35766220250e96ae5315fd790c3110d689cee4a3a75dfe3088fd929ae2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~$Normal.dotm","sha256":"6ad791541c8df5f3182e827719f950756161052aa8b22deec5171d3601cbfa61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~WRD0000.doc","sha256":"8f814a10cc997dfcdff20679f0021ab45ac41b4ff24745fc907af84d936c961e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~WRD0001.doc","sha256":"794322a916bd0d897d15f6a17b82b8834353e8f667e70ae78c9cc951b2dec180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~WRD0002.doc","sha256":"18f1024685d2ac4d40ae7fcbc673543e95e49d3ca9b03d7372339783f828aea9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~WRS{43CD6BED-BEA9-46EF-A7AD-2B96C0BC2901}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~WRS{55674513-8133-422F-BF1D-C522890ACD58}.tmp","sha256":"a0398642ab7db5c6dd66eb4a91ba81facda63af45765aa574b2e36daceb5c3b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"~$xml6_x64.msi.rtf","sha256":"6ad791541c8df5f3182e827719f950756161052aa8b22deec5171d3601cbfa61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"MSI280D.tmp","sha256":"251e9aa1f3446151f0d40fd39f20b797b8af73efe243a4b27950250dbf5aab18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"21EA03E12A6F9D076B6BC3318EA9363E_FB4F1E022CC2E2F375B3F847CC606B14","sha256":"bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"303572DF538EDD8B1D606185F1D559B8","sha256":"ed011fe49fb2210faa58364dd1db2d85d75ad424df50a46168c33e560316546c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A","sha256":"bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"79841F8EF00FBA86D33CC5A47696F165","sha256":"505203a7ac2264a667bea4e1be51447eed9f926ffc18336bf208071a822024d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}],"files_written":[{"path":"C:\\msxml6_x64.msi","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\msimsg.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\en-US\\msimsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\sxs.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\en-US\\sxs.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\bg-BG\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\ar-SA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\da-DK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\cs-CZ\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\de-DE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\msiexec.exe.config","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%WINDIR%\\System32\\en\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E6024EAC88E6B6165D49FE3C95ADD735","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E6024EAC88E6B6165D49FE3C95ADD735","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\el-GR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\en\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\es-ES\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\et-EE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\fi-FI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\fr-FR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\he-IL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\hr-HR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\hu-HU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\it-IT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\ja-JP\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\ko-KR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\lt-LT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\lv-LV\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\nb-NO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\nl-NL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\pl-PL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\pt-BR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\pt-PT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\ro-RO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\ru-RU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\sk-SK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\sl-SI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\sr-Latn-CS\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\sv-SE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\th-TH\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\tr-TR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\uk-UA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\zh-CN\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\zh-HK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\system32\\zh-TW\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{43CD6BED-BEA9-46EF-A7AD-2B96C0BC2901}.tmp","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%TEMP%\\~DF235227115D20B398.TMP","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"C:\\~$xml6_x64.msi.rtf","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%TEMP%\\~DFAF45C7BDE4D89A56.TMP","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%TEMP%\\~DF4895364FA09201DB.TMP","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\mlang.dat","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{55674513-8133-422F-BF1D-C522890ACD58}.tmp","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0000.doc","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0002.doc","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D53A03E7-9A18-4674-92D1-98BA5A405225}.tmp","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\msxml6_x64.msi","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"C:\\msxml6_x64.msi.rtf","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\msxml6_x64.msi.LNK","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\stdnames.gpd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\NL7MODELS0009.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CMAdj.9.bin","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\303572DF538EDD8B1D606185F1D559B8","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\303572DF538EDD8B1D606185F1D559B8","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\21EA03E12A6F9D076B6BC3318EA9363E_FB4F1E022CC2E2F375B3F847CC606B14","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\79841F8EF00FBA86D33CC5A47696F165","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\79841F8EF00FBA86D33CC5A47696F165","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\SECURE\\","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MATHFONTS\\","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\SECURITY\\TRUSTED DOCUMENTS\\","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"5f737a42c73df25eca147caf"},{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a0ea6e786fe16cf2d0ea722"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4496:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"Local\\SM0:4496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"Local\\SM0:4496:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]},{"name":"Local\\SM0:3148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63c8d5f29f439869f121e6c6"}]}]}},"report_ids":{"sandbox_job_ids":["63c8d5f29f439869f121e6c6","5f737a42c73df25eca147caf","5a0ea6e786fe16cf2d0ea722"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Clean Sample 9e55c254d48e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 9e55c254d48e…. Threat score 0/100. 0/26 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 9e55c254d48e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 9e55c254d48e…. Threat score 0/100. 0/26 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9e55c254d48eb0307aa3465bddff91ba863de8dd34598f59e18ad559dba18df9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 9e55c254d48e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 9e55c254d48e…. Threat score 0/100. 0/26 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]