24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious PUP.Generic Sample bb7c648791d9… — Score 76/100 — Hybrid Analysis","description":"Suspicious verdict for sample bb7c648791d9…. Malware family: PUP.Generic. Threat score 76/100. 1/27 AV engines flagged this file. 0 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","keywords":["Suspicious","PUP.Generic","malware analysis","sandbox report","threat intelligence","bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533"],"about":{"@type":"SoftwareApplication","name":"WCInstaller (20).exe","applicationCategory":["peexe","assembly","executable"],"identifier":"bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","additionalType":"Suspicious sample"},"threatScore":76,"malwareFamily":"PUP.Generic","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1d2a,Found reference to "ZipCryptoStream" (Indicator: "CryptoStream"; File: "WCInstaller _20_.exe") Found reference to "MethodWinZipAes" (Indicator: "Aes"; File: "WCInstaller _20_.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "WCInstaller _20_.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "WCInstaller _20_.exe") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "WCInstaller _20_.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "WCInstaller _20_.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "WCInstaller _20_.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004472-00000BC0-1107470128") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp")26:T4f2,Contains base64 string in header "POST" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive" Contains base64 string in header "stat" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive" Contains base64 string in header "1Content" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive" Contains base64 string in header "application/jsonHost" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 311Connection: Keep-Alive"27:T92e,file/memory contains long string(Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "OSVersion" (Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string ","PartnerId":null,"OSVersion":"Microsoft Windows 10 Pro","ProductVersion":null,"Message":"Another instance is already running.","OsBit":" (Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "{ CampaignId = {0}, InstallId = {1}, Language = {2}, MachineId = {3}, PartnerId = {4}, OSVersion = {5}, ProductVersion = {6}, InstallerLaunch = {7}, InstallerStatus = {8}, InstallerMessage = {9}, OsBit = {10}, InstallDate = {11} }}" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "{ CampaignId = {0}, InstallId = {1}, Language = {2}, MachineId = {3}, PartnerId = {4}, OSVersion = {5}, ProductVersion = {6}, Message = {7}, OsBit = {8}, CreateDate = {9} }}" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "ELECT UserName FROM Win32_ComputerSystem" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "i__Field" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "k__BackingField" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "get_UserName" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "set_UserName" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "get_OSVersion" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "GetOSVersion" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "j__TPar" (Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "Environment.OSVersion / GetVersionEx. Without it Windows shims the version to 6.2" (Source: "00000000-00004472.00000001.135767.28BB0000.00000002.mdmp") Found string "SystemService.GetOSVersionForChannel, which would then report every machine as "Other". -->" (Source: "00000000-00004472.00000001.135767.28BB0000.00000002.mdmp")28:T9fa,"WCInstaller_20_.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000b0aff3a36300000019b0f3a363000000010000000000000000000000000000001b62f2edfc7f0000b0aff3a363000000809e82d7fc7f000019b0f3a363000000809e82d7fc7f0000f89582d7fc7f00008f6af2edfc7f0000b0aff3a36300000004988910fd7f00000cc53f46920100007809080000000000f89582d7fc7f0000c85df2edfc7f0000b0aff3a3630000000bf5ec0cfd7f00006d00690074006d00700072006f00780079002d007400720061006e00730070006100720065006e0074002d00700072006f00780079002d003400380038003400000056004900440045005200000000002d000000fc7f0000100000000000000003000000 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004472)29:T47b,"WCInstaller_20_.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000006c0c4f626a65637400000000000000000000000000000000000000000000000000000000000000002014a12c9201000000000000000000000300000000000000c467f4edfc7f00001000000000000000100000000000000030eeafa46300000080000000000000001000000000000000a169b0fbfc7f000000000000 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004873da2a920100004873da2a92010000000000000000000014efafa46300000018f0afa463000000ffffffff0000000074efafa4630000000000000000000000c467f4edfc7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169b0fbfc7f00000832da2a (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000f00000000000000e3ff5cdd32c50000ffffffff000000000300000000000000606eae2c920100002014a12c920100000000000000000000c467f4edfc7f0000100000000000000010000000000000000300000000000000a0f0afa4630000001000000000000000a169b0fbfc7f00001f000000 (UID: 00000000-00004472)2a:Ta55,"WCInstaller_20_.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")2b:T53d,"WCInstaller_20_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WCInstaller_20_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2c:T151f,"WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00004472) "WCInstaller_20_.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00004472)2d:T5986,"WCInstaller_20_.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter _free_base (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004472) "WCInstaller_20_.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004472)2e:T491,"SELECT LastBootUpTime FROM Win32_OperatingSystem" (Source: WCInstaller _20_.exe, Indicator: "select lastbootuptime from win32_operatingsystem") "SELECT Caption FROM Win32_OperatingSystem" (Source: WCInstaller _20_.exe, Indicator: "select caption from win32_operatingsystem") "Select * From Win32_Process Where ProcessID =" (Source: 6000028-ProcessAsUser~GetProcessOwner, Indicator: "select * from win32_process where processid =") "SELECT UserName FROM Win32_ComputerSystem" (Source: 60006d4-RemoveRegistry~GetUsername, Indicator: "select username from win32_computersystem") "SELECT Caption FROM Win32_OperatingSystem" (Source: 00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp, Indicator: "select caption from win32_operatingsystem") "SELECT Caption FROM Win32_OperatingSystem -> Caption" (Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp, Indicator: "select caption from win32_operatingsystem -> caption")2f:T25b1,Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetProcessById"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "LoadResource"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "FindResource"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "SizeofResource"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "LockResource"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "PostMessage"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "CloseHandle"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetTempPath"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "WTSQueryUserToken"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "Sleep"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "CreateProcessAsUser"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetParent"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "FindWindow"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "GetWindow"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "MoveFileEx"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "LoadLibraryEx"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "MessageBox"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "FreeLibrary"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "CreateDirectory"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "DisplayVersion"; File: "WCInstaller _20_.exe") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUser"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryEx"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp")30:T2862,"SOFTWARE\Lavasoft\Web Companion" in Source: WCInstaller _20_.exe "SOFTWARE\Lavasoft\Web Companion\WebProtection" in Source: WCInstaller _20_.exe "SOFTWARE\Clients\StartMenuInternet" in Source: WCInstaller _20_.exe "SOFTWARE\{0}\{1}\{2}" in Source: WCInstaller _20_.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: WCInstaller _20_.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: WCInstaller _20_.exe "SOFTWARE\Wow6432Node\" in Source: WCInstaller _20_.exe "Software\Lavasoft\Web Companion" in Source: WCInstaller _20_.exe "HKEY_USERS\" in Source: WCInstaller _20_.exe "\Software\Microsoft\Windows\CurrentVersion\Run" in Source: WCInstaller _20_.exe "SOFTWARE\\Lavasoft\\Web Companion" in Source: 600012e-WPUninstallMainWindowViewModel~ReadRevertOptions "SOFTWARE\\Lavasoft\\Web Companion\\WebProtection" in Source: 60002d8-WebProtectionMigrationService~SetWebProtectionRebootPending "SOFTWARE\\Clients\\StartMenuInternet" in Source: 60002dd-BrowserUtils~CheckBrowserInstalled "SOFTWARE\\{0}\\{1}" in Source: 600040e-InstallUtils~GetLanguageElevatedAndNonElevated "SOFTWARE\\{0}\\{1}\\{2}" in Source: 6000433-InstallUtils~GenerateWebProtectionRegistry "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" in Source: 6000442-InstallUtils~GetOsCaptionFromRegistry "SOFTWARE\\{0}\\{1}\\" in Source: 600045b-InstallUtils~RemoveWebProtectionRegistry "SOFTWARE\\WOW6432Node\\{0}\\{1}\\" in Source: 600045b-InstallUtils~RemoveWebProtectionRegistry "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" in Source: 600046c-cctor "SOFTWARE\\Wow6432Node\\" in Source: 60006ce-RemoveRegistry~RemoveFromWowNode "Software\\Lavasoft\\Web Companion" in Source: 60006cf-RemoveRegistry~RemoveUnwantedRegValue "HKEY_USERS\\" in Source: 60006d1-RemoveRegistry~RemoveFromRun "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60006d1-RemoveRegistry~RemoveFromRun "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\" in Source: 60006d2-RemoveRegistry~RemoveFromTruestedSiteURL "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\{0}\{1}" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companio" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.450D0000.00000004.mdmp 00000000-00004472.00000001.135767.450D0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}M" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004472.00000001.135767.28B42000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00004472.00000001.135767.28B42000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000001.135767.7ED80000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000001.135767.7ED80000.00000004.mdmp31:T937,"WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "WCInstaller_20_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135]32:T569,Observed unmanaged function "CreateProcessAsUser" in "WCInstaller (20).exe" Observed unmanaged function "DuplicateTokenEx" in "WCInstaller (20).exe" Observed unmanaged function "OpenProcessToken" in "WCInstaller (20).exe" Observed unmanaged function "CreateEnvironmentBlock" in "WCInstaller (20).exe" Observed unmanaged function "DestroyEnvironmentBlock" in "WCInstaller (20).exe" Observed unmanaged function "CloseHandle" in "WCInstaller (20).exe" Observed unmanaged function "WTSGetActiveConsoleSessionId" in "WCInstaller (20).exe" Observed unmanaged function "WTSQueryUserToken" in "WCInstaller (20).exe" Observed unmanaged function "GetDeviceCaps" in "WCInstaller (20).exe" Observed unmanaged function "LoadLibraryEx" in "WCInstaller (20).exe" Observed unmanaged function "FreeLibrary" in "WCInstaller (20).exe" Observed unmanaged function "FindResource" in "WCInstaller (20).exe" Observed unmanaged function "SizeofResource" in "WCInstaller (20).exe" Observed unmanaged function "LoadResource" in "WCInstaller (20).exe" Observed unmanaged function "LockResource" in "WCInstaller (20).exe" Observed unmanaged function "MoveFileEx" in "WCInstaller (20).exe" Observed unmanaged function "PostMessage" in "WCInstaller (20).exe" Observed unmanaged function "FindWindow" in "WCInstaller (20).exe" Observed unmanaged function "SHFileOperation" in "WCInstaller (20).exe"33:T2bb6,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\{0}\{1}" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companio" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.450D0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}M" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.135628.46992000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004472.00000001.135767.28B42000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00004472.00000001.135767.28B42000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\{0}\{1}" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Web Companion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companio" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000001.135767.450D0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004472.00000001.135767.7ED80000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004472.00000001.135767.7ED80000.00000004.mdmp34:Tfc4,"WCInstaller_20_.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffce8e20000 "WCInstaller_20_.exe" loaded module "COMBASE.DLL" at base 7ffd0e960000 "WCInstaller_20_.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd0e960000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd0e960000 "WCInstaller_20_.exe" loaded module "NTDLL.DLL" at base 7ffd10870000 "WCInstaller_20_.exe" loaded module "KERNEL32.DLL" at base 7ffd0e270000 "WCInstaller_20_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcd7860000 "WCInstaller_20_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffcfbb00000 "WCInstaller_20_.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffd0ce90000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffd00f20000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffd03430000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffd01f40000 "WCInstaller_20_.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffd0ce90000 "WCInstaller_20_.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffd0ce90000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffd01270000 "WCInstaller_20_.exe" loaded module "OLEAUT32.DLL" at base 7ffd10770000 "WCInstaller_20_.exe" loaded module "VERSION.DLL" at base 7ffd04590000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd0c060000 "WCInstaller_20_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ffcd77b0000 "WCInstaller_20_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ffcd77b0000 "WCInstaller_20_.exe" loaded module "WEBENGINE4.DLL" at base 7ffcd77b0000 "WCInstaller_20_.exe" loaded module "OLE32.DLL" at base 7ffd0e320000 "WCInstaller_20_.exe" loaded module "ADVAPI32.DLL" at base 7ffd0f220000 "WCInstaller_20_.exe" loaded module "MSCOREE.DLL" at base 7ffcfa900000 "WCInstaller_20_.exe" loaded module "RASAPI32.DLL" at base 7ffd013e0000 "WCInstaller_20_.exe" loaded module "RASMAN.DLL" at base 7ffd01360000 "WCInstaller_20_.exe" loaded module "WS2_32.DLL" at base 7ffd0e5b0000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd0c450000 "WCInstaller_20_.exe" loaded module "WINHTTP.DLL" at base 7ffd09180000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffcee860000 "WCInstaller_20_.exe" loaded module "IPHLPAPI.DLL" at base 7ffd0c1e0000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd05530000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd05b50000 "WCInstaller_20_.exe" loaded module "SECUR32.DLL" at base 7ffd03fd0000 "WCInstaller_20_.exe" loaded module "SSPICLI.DLL" at base 7ffd0cac0000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffd0bfa0000 "WCInstaller_20_.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffcfe560000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffcfeb10000 "WCInstaller_20_.exe" loaded module "CRYPT32.DLL" at base 7ffd0d970000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffd0de20000 "WCInstaller_20_.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffd0e320000 "WCInstaller_20_.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffd0e630000 "WCInstaller_20_.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffd0e630000 "WCInstaller_20_.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffd0e960000 "WCInstaller_20_.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 7ffcfb40000035:Td97,Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004472-00000C2B-1108007194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004472-00000C2B-1108049633] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004472-00000C2B-1108106455] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00004472-00000C2B-1108123363] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004472-00000C2B-1108252444] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004472-00000C2B-1108310013] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00004472-00000C2B-1108349885] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll" [Source: 00000000-00004472-00000C2B-1108501206] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll" [Source: 00000000-00004472-00000C2B-1108511970] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll" [Source: 00000000-00004472-00000C2B-1108545495] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll" [Source: 00000000-00004472-00000C2B-1108555473] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll" [Source: 00000000-00004472-00000C2B-1108565658] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" [Source: 00000000-00004472-00000C2B-1108576775] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00004472-00000C2B-1108677379] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00004472-00000C2B-1108729456] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00004472-00000C2B-1108763730] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00004472-00000C2B-1108842003] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00004472-00000C2B-1109005763] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004472-00000C2B-1109138147] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004472-00000C2B-1109189793] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" [Source: 00000000-00004472-00000C2B-1114229940]36:T536,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 71:14:1A:3A:23:C3:6E:73:19:4A:78:CE:E1:26:CC:AE:ED:E4:51:02; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 41:B3:71:8E:CA:EB:90:F4:52:BD:5E:41:07:5E:E8:57:99:27:81:C0; see report for more information)37:T727,"WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WCINSTALLER_20_.EXE"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")38:Td26,"WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "")39:T5d4,"WCInstaller_20_.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentatio5ae0f00f#\ec5e61c1f67279c3ebe8bd1160c680a7\presentationframework.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\windowsbase\40bd456a59a4969ec46e7d7fef6b5e32\windowsbase.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentationcore\2e48700efecd23d15226baaa35a854bb\presentationcore.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xaml\0212deecd5dfa435c6588fd68900ab8c\system.xaml.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "WCInstaller_20_.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"3a:T458,"WCInstaller_20_.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "WCInstaller_20_.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "WCInstaller_20_.exe" trying to touch file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "WCInstaller_20_.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "WCInstaller_20_.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "WCInstaller_20_.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "WCInstaller_20_.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "WCInstaller_20_.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "WCInstaller_20_.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WCInstaller_20_.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WCInstaller_20_.exe" trying to touch file "\Device\CNG" "WCInstaller_20_.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WCInstaller_20_.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL"3b:Ta76,"WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\CRYPTSP.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\BCRYPT.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\bcrypt.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\UCRTBASE_CLR0400.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" "WCInstaller_20_.exe" trying to access non-existent file "C:\MSVCP140_CLR0400.DLL" "WCInstaller_20_.exe" trying to access non-existent file "C:\MSVCP140_CLR0400.dll"3c:T722,"WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "WCInstaller_20_.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "WCInstaller_20_.exe" trying to access non-existent file "C:\WCINSTALLER_20_.EXE.CONFIG" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "WCInstaller_20_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WCINSTALLER_20_.EXE.LOG" "WCInstaller_20_.exe" trying to access non-existent file "C:\WCInstaller_20_.exe.config" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\WCINSTALLER" "WCInstaller_20_.exe" trying to access non-existent file "C:\WCINSTALLER_20_.INI" "WCInstaller_20_.exe" trying to access non-existent file "C:\WCInstaller_20_.INI" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "WCInstaller_20_.exe" trying to access non-existent file "C:\ProgramData\LAVASOFT" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.WEB.28B9EF5A#" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.WEB.EXTENSIONS.INI" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.WEB" "WCInstaller_20_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.WEB.INI"3d:T2bfa,Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Pattern match: "http://schemas.openxmlformats.org/markup-compatibility/2006" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://+:9007/" Pattern match: "http://localhost:9007/" Heuristic match: "flwadw.com" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "*.flwadw.com" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://flwadw.com" Pattern match: "https://flwadw.com/v1/event-stat-wc" Pattern match: "https://flwadw.com/v1/event-stat" Pattern match: "https://staging-cloudflow.lavasoft.net" Pattern match: "https://staging-cloudflow.lavasoft.net/v1/event-stat-wc" Pattern match: "https://staging-cloudflow.lavasoft.net/v1/event-stat" Pattern match: "https://flwadw.com/v1/event-stat?type=error&productid=wc&eventversion=1" Pattern match: "http://flwadw.com" Heuristic match: "host: flwadw.com" Heuristic match: "w.com" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.thawte.com/cps07" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microo" Pattern match: "microsoft.net/assembly/gac_64/presentationcore/v4.0_4.0.0.0__31bf3856ad364e35/presentationcore.dll"3e:T46eb,Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0&)6x&" - Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lbay>" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0&)6x&" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?esilw" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;r*uw" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3s+lw" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microo010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004472.00000000.135628.450D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004472.00000001.135767.28BB0000.00000002.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0&)6x&" - Source: "00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lbay>" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0&)6x&" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?esilw" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;r*uw" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3s+lw" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microo010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004472.00000001.135767.450D0000.00000004.mdmp")3f:Ta26,"WCInstaller_20_.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\* (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter b221af81285c1305324612e6dc9c88ff (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Web.28b9ef5a#\* (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Web\* (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\config\machine.config (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter lsass (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter ntsvcs (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter scerpc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Winsock2\CatalogChangeListener-3a0-0 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter epmapper (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Winsock2\CatalogChangeListener-1fc-0 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter LSM_API_service (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter eventlog (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Winsock2\CatalogChangeListener-49c-0 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter TermSrv_API_service (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Ctx_WinStation_API_service (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter atsvc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter wkssvc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter SessEnvPublicRpc (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Winsock2\CatalogChangeListener-830-0 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter Winsock2\CatalogChangeListener-710-0 (UID: 00000000-00004472) "WCInstaller_20_.exe" called "FindNextFileW" with parameter srvsvc (UID: 00000000-00004472)40:T1ada,Found string "_useZipFile" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "ExtractZipFile" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "WCZipFileName" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "SearchModuleZipFileName" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "WebprotectionZipFileName" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "_zipFileName" (Indicator: "zipfile"; File: "WCInstaller _20_.exe") Found string "ZipCryptoStream" (Indicator: "cryptostream"; File: "WCInstaller _20_.exe") Found string "MethodWinZipAes" (Indicator: "aes"; File: "WCInstaller _20_.exe") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp")41:T426,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "WCInstaller _20_.exe") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "WCInstaller _20_.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WCInstaller _20_.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp")42:T754,Found string "password" (Indicator: "password"; File: "WCInstaller _20_.exe") Found string "Entry is encrypted and no password was supplied." (Indicator: "password"; File: "WCInstaller _20_.exe") Found string "Wrong password for encrypted entry." (Indicator: "password"; File: "WCInstaller _20_.exe") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "ntry is encrypted and no password was supplied." (Indicator: "password"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "rong password for encrypted entry." (Indicator: "password"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp")43:T42b,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: WCInstaller _20_.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companio" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Companion" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004472.00000001.135767.28B42000.00000002.mdmp44:Tb3f,Found string "SELECT LastBootUpTime FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "WCInstaller _20_.exe") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "WCInstaller _20_.exe") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "WcInstaller.log") Found string "Select * From Win32_Process Where ProcessID =" (Indicator: " Win32_Process"; File: "WCInstaller _20_.exe") Found string "SELECT UserName FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "WCInstaller _20_.exe") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "[2026-10-01 14:02:18] [Info] WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 msdling" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "[2026-10-01 14:02:18] [Info] WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 ms" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem -> Caption" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 ms" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") Found string "elect * From Win32_Process Where ProcessID =" (Indicator: " Win32_Process"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "ELECT LastBootUpTime FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") Found string "ELECT UserName FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp")45:T9ff,"WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\PERFORMANCE"; Key: "LIBRARY"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "WCInstaller_20_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")46:Tafa,"WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\LAVASOFT\WEB COMPANION"; Key: "MACHINEID"; Value: "bfd7b2e9-d1a2-429c-8b47-d1857c2c0d93") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "RU5YCPA6ZH90LVPHZSEEG3T2DS9GPQB9YFI7TNS6MA4CETTETQJFXTULFLTX0TEHDAVFL7RQQHGZB8HXTCRIANI17TEOYMEJUUK8CN9SKN2NBC2XRVWE9H"; Value: "7811000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WCINSTALLER_20__RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "WCInstaller_20_.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")47:T7cf,Found string "WTSGetActiveConsoleSessionId" (Source: WCInstaller _20_.exe, API is part of module: KERNEL32.DLL) Found string "LoadResource" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "SizeofResource" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "LockResource" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "CreateEnvironmentBlock" (Source: WCInstaller _20_.exe, API is part of module: USERENV.DLL) Found string "DestroyEnvironmentBlock" (Source: WCInstaller _20_.exe, API is part of module: USERENV.DLL) Found string "OpenProcessToken" (Source: WCInstaller _20_.exe, API is part of module: ADVAPI32.DLL) Found string "Sleep" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "GetAppDataFolder" (Source: WCInstaller _20_.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "remainder" (Source: WCInstaller _20_.exe, API is part of module: UCRTBASE_CLR0400.DLL) Found string "UpdateError" (Source: WCInstaller _20_.exe, API is part of module: MSCOREEI.DLL) Found string "GetDeviceCaps" (Source: WCInstaller _20_.exe, API is part of module: GDI32FULL.DLL) Found string "GetCurrentProcess" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "GetParent" (Source: WCInstaller _20_.exe, API is part of module: USER32.DLL) Found string "GetWindow" (Source: WCInstaller _20_.exe, API is part of module: USER32.DLL) Found string "DuplicateTokenEx" (Source: WCInstaller _20_.exe, API is part of module: ADVAPI32.DLL) Found string "ReleaseMutex" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: WCInstaller _20_.exe, API is part of module: KERNELBASE.DLL) Found string "Rectangle" (Source: WCInstaller _20_.exe, API is part of module: GDI32FULL.DLL)48:Tb78,"SELECT LastBootUpTime FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; File: "WCInstaller _20_.exe") "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; File: "WCInstaller _20_.exe") "[2026-10-01 14:02:18] [Info] Application startedIsSingleInstance: AdwareWCInstaller[2026-10-01 14:02:18] [Info] Another instance is already running. Exiting immediately.[2026-10-01 14:02:18] [Info] WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 ms" (Indicator: " win32_operatingsystem"; File: "WcInstaller.log") "Select * From Win32_Process Where ProcessID =" (Indicator: " win32_process"; File: "WCInstaller _20_.exe") "SELECT UserName FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; File: "WCInstaller _20_.exe") "instance of Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp") "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") "[2026-10-01 14:02:18] [Info] WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 msdling" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") "[2026-10-01 14:02:18] [Info] WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 ms" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") "SELECT Caption FROM Win32_OperatingSystem -> Caption" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") "WMI probe 'SELECT Caption FROM Win32_OperatingSystem -> Caption' took 329 ms" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp") "elect * From Win32_Process Where ProcessID =" (Indicator: " win32_process"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") "ELECT LastBootUpTime FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp") "ELECT UserName FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00004472.00000001.135767.28B42000.00000002.mdmp")49:Tbde,"WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WCInstaller_20_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4a:T7d2,Found reference to API "44804512,3000,3025,,RtlGetNtProductType,NTDLL.dll,"00:41:31.671",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "67094398,3000,3025,,RtlGetNtProductType,NTDLL.dll,"00:41:31.765",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "44888974,3000,3024,,RtlGetVersion,NTDLL.dll,"00:41:31.671",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "69039224,3000,3024,,RtlGetVersion,NTDLL.dll,"00:41:31.765",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "65794253,7712,3025,,RtlGetNtProductType,NTDLL.dll,"00:41:31.812",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "79195490,3000,3025,,RtlGetNtProductType,NTDLL.dll,"00:41:31.609",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "970258640,7712,3024,,RtlGetVersion,NTDLL.dll,"00:41:32.265",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp") Found reference to API "879713687,7712,3025,,RtlGetNtProductType,NTDLL.dll,"00:41:33.062",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007700.00000000.159724.F1940000.00000004.mdmp")4b:T400,AAABAAEAICAQEAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJmZkAu7uwAAAAAAAAAAAAmZmZALu7uwAAAAAAAAAAAJmZmZu7u7sAAAAAAAAAAAmZmZmbu7u7sAAAAAAAAAC5mZmZm7u7u7AAAAAAAAAAu7mZmZu7u7u7AAAAAAAAC7u7mZmbu7u7u7AAAAAAAAu7u5mZm7u7u7uwAAAAAAC7u7u5mZu7u7u7uwAAAAAAu7u7uZm7u7u7u7sAAAAAC7u7u7ubu7u7u7u7sAAAALu7u7u7u7u7u7u7u7AAAAC7u7u7u7u7u7u7u7u7AAALu7u7u7u7u7u7u7u7u7AAC7u7u7u7u7u7u7u7u7uwALu7u7u7u7u7u7u7u7u7uwu7u7u7u7u7u7u7u7u7u7sLu7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////////////////nx///48f//8OD//+Bg///gAH//wAB//8AAP/+AAB//gAAf/wAAD/4AAA/+AAAH/AAAA/wAAAP4AAAB+AAAAfAAAADgAAAA4AAAAEAAAAAAAAAAAAAAAAAAAAA/////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":76,"unified_at_epoch_ms":1790892138566,"unified_at":"2026-10-01T22:02:18.566Z","metadata":{"hashes":{"sha256":"bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","sha1":"e76cb9ae97708eb76073fe64ed956be1c00142fa","md5":"ccacad16654fd59c45bd1a34ecb5c6ee","sha512":"8a4d043982f82e1b23973b57cf006c836993244dcade8a9f08af8bc772230974a918345fa5a4882baac38329675d7907408b605c65497fdfb8b5f3522f7bc0f4","ssdeep":"6144:TQsLyOkTA4ahp9EUbIVFSsry3UzpbvkibEoW2HiGYNThKeg0Zrt4+G:TLLyO++9qS81EoWBdFU","ssdeep_chunks":["6144:TQsLyOk","6144:QsLyOkT","6144:sLyOkTA","6144:LyOkTA4","6144:yOkTA4a","6144:OkTA4ah","6144:kTA4ahp","6144:TA4ahp9","6144:A4ahp9E","6144:4ahp9EU","6144:ahp9EUb","6144:hp9EUbI","6144:p9EUbIV","6144:9EUbIVF","6144:EUbIVFS","6144:UbIVFSs","6144:bIVFSsr","6144:IVFSsry","6144:VFSsry3","6144:FSsry3U","6144:Ssry3Uz","6144:sry3Uzp","6144:ry3Uzpb","6144:y3Uzpbv","6144:3Uzpbvk","6144:Uzpbvki","6144:zpbvkib","6144:pbvkibE","6144:bvkibEo","6144:vkibEoW","6144:kibEoW2","6144:ibEoW2H","6144:bEoW2Hi","6144:EoW2HiG","6144:oW2HiGY","6144:W2HiGYN","6144:2HiGYNT","6144:HiGYNTh","6144:iGYNThK","6144:GYNThKe","6144:YNThKeg","6144:NThKeg0","6144:ThKeg0Z","6144:hKeg0Zr","6144:Keg0Zrt","6144:eg0Zrt4","6144:g0Zrt4+","6144:0Zrt4+G","12288:TQsLyOk","12288:QsLyOkT","12288:sLyOkTA","12288:LyOkTA4","12288:yOkTA4a","12288:OkTA4ah","12288:kTA4ahp","12288:TA4ahp9","12288:A4ahp9E","12288:4ahp9EU","12288:ahp9EUb","12288:hp9EUbI","12288:p9EUbIV","12288:9EUbIVF","12288:EUbIVFS","12288:UbIVFSs","12288:bIVFSsr","12288:IVFSsry","12288:VFSsry3","12288:FSsry3U","12288:Ssry3Uz","12288:sry3Uzp","12288:ry3Uzpb","12288:y3Uzpbv","12288:3Uzpbvk","12288:Uzpbvki","12288:zpbvkib","12288:pbvkibE","12288:bvkibEo","12288:vkibEoW","12288:kibEoW2","12288:ibEoW2H","12288:bEoW2Hi","12288:EoW2HiG","12288:oW2HiGY","12288:W2HiGYN","12288:2HiGYNT","12288:HiGYNTh","12288:iGYNThK","12288:GYNThKe","12288:YNThKeg","12288:NThKeg0","12288:ThKeg0Z","12288:hKeg0Zr","12288:Keg0Zrt","12288:eg0Zrt4","12288:g0Zrt4+","12288:0Zrt4+G","6144:TLLyO++","6144:LLyO++9","6144:LyO++9q","6144:yO++9qS","6144:O++9qS8","6144:++9qS81","6144:+9qS81E","6144:9qS81Eo","6144:qS81EoW","6144:S81EoWB","6144:81EoWBd","6144:1EoWBdF","6144:EoWBdFU"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"WCInstaller (20).exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":485016,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790888508000,"last_seen":1790892026000,"last_multi_scan":1790892026000}},"detections":{"summary":{"verdict":"suspicious","score":76,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":191,"suspicious_count":12,"malicious_count":0,"total":203},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 005cf1b21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"PUP.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Able to unregister service from Service Control Manager"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"suspicious","value":"Contains ability to start a new process with local system privileges"},{"type":"informative","value":"Contains ability to create process with token (API string)"},{"type":"suspicious","value":"Possibly tries to hide a process launching it with different user credentials"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve security identifier details"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an adware detecting tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string \"nsupported compression method\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"_useZipFile\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"ExtractZipFile\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"WCZipFileName\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"SearchModuleZipFileName\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"WebprotectionZipFileName\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"WCInstaller (20).exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetLastWin32Error\" in \"WCInstaller (20).exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"Copy\" in \"WCInstaller (20).exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"StringToHGlobalUni\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"TryDeleteServiceFolder\" (File: \"WCInstaller _20_.exe\")\n Found string \"TryDeleteServiceFolder\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"OpenProcessToken Error: {0}\" (Indicator: \"OpenProcessToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"WCInstaller (20).exe has big resource with name: \"ui/resourcedictionary/bg.png\" size: \"32414\" and abnormal entropy:\"7.746039852540631\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004472-00002713-1108251680\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string - \\.\\pipe\\ru5YcpA6Zh90lVPHZSeEG3T2Ds9gpQb9Yfi7TNS6MA4cEtTeTQjFxtULflTx0TEhDAVFl7RQqHgZb8hXTCriAnI17TEoymeJuuK8CN9skN2NbC2XRvwE9h; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WCInstaller_20_.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"WCInstaller_20_.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"WCInstaller_20_.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")\n \"WCInstaller_20_.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\")\n \"WCInstaller_20_.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\")\n \"WCInstaller_20_.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"WCInstaller_20_.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEM\\DNSCLIENT\")\n \"WCInstaller_20_.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\")\n \"WCInstaller_20_.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\")\n \"WCInstaller_20_.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WCInstaller_20_.exe\" queried SystemProcessInformation at 00000000-00004472-00000C15-1107793373 [PID: 4472]\n \"WCInstaller_20_.exe\" queried SystemProcessInformation at 00000000-00004472-00000C15-1107802331 [PID: 4472]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 417244; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 113742; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 125471; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 182734; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 462397; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 477408; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 480128; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004472-00000C2C-1108095157\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"WCInstaller (20).exe\"\n Observed dotnet function \"GetDirectories\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004472-00000C2C-1108095157\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"WCInstaller _20_.exe\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"WCInstaller _20_.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Web Companio\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Web Companion\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004472-00000C2C-1108944266\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"FindWindow\" (Indicator: \"findwindow\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"FindWindow\" (Indicator: \"findwindow\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WCInstaller_20_.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WCInstaller_20_.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004472)\n \"WCInstaller_20_.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WCInstaller_20_.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WCInstaller_20_.exe\" called \"GetActiveWindow\" (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WCInstaller_20_.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WCInstaller_20_.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004472)\n \"WCInstaller_20_.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00004472)\n \"WCInstaller_20_.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00004472)\n \"WCInstaller_20_.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From Win32_Process Where ProcessID =\" (Indicator: \"select * from \"; File: \"WCInstaller _20_.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at ccacad16654fd59c45bd1a34ecb5c6ee-6000405-InstallUtils~GetSelfVersion\n System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at ccacad16654fd59c45bd1a34ecb5c6ee-6000407-InstallUtils~GetInstalledWcVersion\n System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at ccacad16654fd59c45bd1a34ecb5c6ee-6000414-InstallUtils~CreateUninstaller\n System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at ccacad16654fd59c45bd1a34ecb5c6ee-6000416-InstallUtils~CreateUninstallerInfoKeys","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve security identifier details","description":"Observed Namespace \"System.Security.Principal.SecurityIdentifier\" and MemberReference \".ctor\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-156","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"WCInstaller _20_.exe\")\n file/memory contains long string with (Indicator: \"GetVersion\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"Environment.OSVersion / GetVersionEx. Without it Windows shims the version to 6.2\" (Indicator: \"GetVersion\"; Source: \"00000000-00004472.00000001.135767.28BB0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"ProcessAsUser::OpenProcessToken(System.IntPtr,System.UInt32,System.IntPtr&) at ccacad16654fd59c45bd1a34ecb5c6ee-600002a-ProcessAsUser~GetPrimaryToken","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WCInstaller_20_.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WCInstaller_20_.exe\" queries volume information of \"C:\\WCInstaller_20_.exe\" at 00000000-00004472-00000C17-1107473274","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WEB COMPANION\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"Select * From Win32_Process Where ProcessID =\" (Indicator: \" Win32_Process\"; File: \"WCInstaller _20_.exe\")\n Found string \"elect * From Win32_Process Where ProcessID =\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueKind\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"OpenProcessToken\" in \"WCInstaller (20).exe\"\n Observed API \"LoadLibraryEx\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineArgs\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"WCInstaller_20_.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ru5YcpA6Zh90lVPHZSeEG3T2Ds9gpQb9Yfi7TNS6MA4cEtTeTQjFxtULflTx0TEhDAVFl7RQqHgZb8hXTCriAnI17TEoymeJuuK8CN9skN2NbC2XRvwE9h\" - (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"WCInstaller _20_.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"flwadw.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.18.27.149:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\agent\\_work\\3\\s\\WebCompanion\\Installer\\WCInstaller\\obj\\Release\\WCInstaller.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessAsUser\" (Indicator: \"CreateProcess\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"CreateProcessAsUser Error: {0}\" (Indicator: \"CreateProcess\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"CreateProcessAsUser\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"OpenRead\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"FindResource\" (Indicator: \"FindResource\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"FindResource\" (Indicator: \"FindResource\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"DeleteUtils: MoveFileEx(DELAY_UNTIL_REBOOT) failed for\" (Indicator: \"MoveFile\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"eleteUtils: MoveFileEx(DELAY_UNTIL_REBOOT) failed for\" (Indicator: \"MoveFile\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"WCInstaller (20).exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"WCInstaller (20).exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"InteropSHFileOperation\" (Indicator: \"SHFileOperation\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"InteropSHFileOperation\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WCInstaller_20_.exe created mutex with name \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n Process WCInstaller_20_.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4472:304:WilStaging_02\"\n Process WCInstaller_20_.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4472:304:WilStaging_02\"\n Process WCInstaller_20_.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4472:120:WilError_01\"\n Process WCInstaller_20_.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\AdwareWCInstaller\"\n Process WCInstaller_20_.exe created mutex with name \"SM0:4472:304:WilStaging_02\"\n Process WCInstaller_20_.exe created mutex with name \"Local\\SM0:4472:304:WilStaging_02\"\n Process WCInstaller_20_.exe created mutex with name \"SM0:4472:120:WilError_01\"\n Process WCInstaller_20_.exe created mutex with name \"AdwareWCInstaller\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"WCInstaller (20).exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WCInstaller (20).exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"4@tzres.dll\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$32","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\ru5YcpA6Zh90lVPHZSeEG3T2Ds9gpQb9Yfi7TNS6MA4cEtTeTQjFxtULflTx0TEhDAVFl7RQqHgZb8hXTCriAnI17TEoymeJuuK8CN9skN2NbC2XRvwE9h\n Found string - \\.\\pipe\\ru5YcpA6Zh90lVPHZSeEG3T2Ds9gpQb9Yfi7TNS6MA4cEtTeTQjFxtULflTx0TEhDAVFl7RQqHgZb8hXTCriAnI17TEoymeJuuK8CN9skN2NbC2XRvwE9h","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"WCInstaller_20_.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at DCC20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WCInstaller_20_.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0CC70000\n \"WCInstaller_20_.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0C720000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"WCInstaller_20_.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at DE220000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WCInstaller_20_.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0F0C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WCInstaller (20).exe\" was detected as \".NET\" and name: \"Library\"\n \"WCInstaller (20).exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WCInstaller_20_.exe\" touched \"WbemDefaultPathParser\" (Path: \"HKCU\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\INPROCSERVER32\")\n \"WCInstaller_20_.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\INPROCSERVER32\")\n \"WCInstaller_20_.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"WCInstaller_20_.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"WCInstaller_20_.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"WCInstaller_20_.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"WCInstaller (20).exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"WCInstaller (20).exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WCInstaller (20).exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"WCInstaller (20).exe\" file has an entrypoint instructions - \"jmp\tdword ptr [0x402000],das\t,add\tbyte ptr [edi], bh,add\tbyte ptr [ebx], ah,add\tbyte ptr [eax], al,add\tbyte ptr [eax - 0x5c], bh,push\t-0x29,push\tesi,mov\tbh, 0xc7,call\t0x24675157,out\tdx, al,into\t,mov\tebp, 0x7c0fafc1,cmc\t,sub\tal, dh,xchg\tdword ptr [edi + 0x13], eax,inc\tesi,xor\tbyte ptr [eax - 0x2b96aff], ch,fcomp\tdword ptr [eax - 0x8509680],inc\tesp,mov\tesi, dword ptr [ecx - 0x410000a5],xlatb\t,pop\tesp,mov\tdword ptr [edx], esp,adc\tdword ptr [eax - 0x678e6c95], edx,std\t,mov\tes, word ptr [ebx + 0x79],cmpsb\tbyte ptr [esi], byte ptr es:[edi],and\tdword ptr [eax], ecx,mov\tah, 0x49,bound\tesp, qword ptr [0xb340f61e],inc\teax,rcl\tbyte ptr [ecx + 0x5a], 0x5e,stosb\tbyte ptr es:[edi], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Lavasoft\" (Indicator: \"lavasoft\") in Source: WCInstaller _20_.exe\n \"(R) Lavasoft\" (Indicator: \"lavasoft\") in Source: WCInstaller _20_.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"flwadw.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WCInstaller_20_.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$36","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WCInstaller_20_.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\WcInstaller.log\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"WCInstaller.AppCore.RemoveRegistry::GetUsername() at ccacad16654fd59c45bd1a34ecb5c6ee-60006d3-RemoveRegistry~GetUserSID","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WCInstaller_20_.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"WCInstaller_20_.exe.log\" has type \"CSV ASCII text\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\WCInstaller_20_.exe.log]- [targetUID: 00000000-00004472]\n \"WcInstaller.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\WcInstaller.log]- [targetUID: 00000000-00004472]\n \"Statistics.txt\" has type \"JSON text data\"- Location: [%ALLUSERSPROFILE%\\Lavasoft\\Web Companion\\Options\\Statistics.txt]- [targetUID: 00000000-00004472]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WCInstaller_20_.exe\" queries basic process information of the \"C:\\WCInstaller_20_.exe\" (UID: 4472)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WCInstaller_20_.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"RegisterTaskDefinition\" (Indicator: \"RegisterTask\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"RegisterTaskDefinition\" (Indicator: \"RegisterTaskDefinition\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"Schedule.Service\" (Indicator: \"Schedule.Service\"; File: \"WCInstaller _20_.exe\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WCInstaller_20_.exe\" writes file \"c:\\programdata\\lavasoft\\web companion\\options\\statistics.txt\"\n \"WCInstaller_20_.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\wcinstaller.log\"\n \"WCInstaller_20_.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\wcinstaller_20_.exe.log\"\n \"WCInstaller_20_.exe\" writes file \"%allusersprofile%\\lavasoft\\web companion\\options\\statistics.txt\"\n \"WCInstaller_20_.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0\\usagelogs\\wcinstaller_20_.exe.log\"\n \"WCInstaller_20_.exe\" writes file \"%temp%\\wcinstaller.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WCInstaller_20_.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\WcInstaller.log\"\n \"WCInstaller_20_.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\WCInstaller_20_.exe.log\"\n \"WCInstaller_20_.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\WCInstaller_20_.exe.log\"\n \"WCInstaller_20_.exe\" writes a file \"%TEMP%\\WcInstaller.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"WCInstaller (20).exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004472-00000C2C-1108752029\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004472-00000C2C-1108751915\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004472-00000C2C-1108810129\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004472-00000C2C-1108810154\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"WCInstaller (20).exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"OpenRead\" in \"WCInstaller (20).exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_ReadWriteTimeout\" in \"WCInstaller (20).exe\"\n Observed Namespace \"System.Net.HttpWebResponse\" and MemberReference \"get_StatusCode\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.28B42000.00000002.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"EndGetRequestStream\" (Indicator: \"EndGetRequestStream\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"EndGetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004472-00000C2C-1108751915\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately.\" (Indicator: \" socket \"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately\" (Indicator: \" socket \"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"ailed to send event {0} {1}\" (Indicator: \" send \"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"17.0.0.0\"\n \"16.0.0.0\"\n \"1.0.0.0\"\n Potential IP \"4.0.0.14\" found in string \"/dci/4.0.0.14/Webprotection.zip\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0, Cultur\"\n \"2.5.29.16\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"192.168.0.1\"\n \"255.255.255.255\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.32\"\n Potential IP \"4.0.0.14\" found in string \"dci/4.0.0.14/Webprotection.zip\"\n Potential IP \"17.14.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t17.14.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:9007\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://flwadw.com/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"flwadw.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.18.27.149\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"get_StagingCloudflowLavasoftDomain\" (Indicator: \"gcloud\"; File: \"WCInstaller _20_.exe\")\n Found string \"get_StagingCloudflowLavasoftDomain\" (Indicator: \"gcloud\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE6BBCD40D9589CB525713DAEA69E7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEDF89C8FC98F5CB99B8571666412E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE6BBCD40D9589CB525713DAEA69E7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WCInstaller_20_.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WCInstaller_20_.exe\" called \"GetComputerNameW\" (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"WCInstaller_20_.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"192450f4cd0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"WCInstaller (20).exe\"\n Observed function \"GetProcessesByName\" in \"WCInstaller (20).exe\"\n Observed function \"get_ProcessName\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at ccacad16654fd59c45bd1a34ecb5c6ee-600056f-InstallerBootstrapper~IsAdministrator","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$42","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$44","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"ServiceController\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found string \"ServiceControllerStatus\" (Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004472.00000000.135628.2ACC0000.00000004.mdmp, 00000000-00004472.00000001.135767.2ACC0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\WCInstaller_20_.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004472.00000000.135628.450D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"WCInstaller (20).exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"CreateProcessAsUser Error: {0}\" (Indicator: \"CreateProcessAsUser\"; File: \"WCInstaller _20_.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryRecursive\" (Indicator: \"RemoveDirectory\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"RemoveDirectoryRecursive\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"DuplicateTokenEx Error: {0}\" (Indicator: \"DuplicateToken\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"DuplicateTokenEx Error: {0}\" (Indicator: \"DuplicateTokenEx\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00004472.00000000.135628.2CA10000.00000004.mdmp, 00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WCInstaller_20_.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"RU5YCPA6ZH90LVPHZSEEG3T2DS9GPQB9YFI7TNS6MA4CETTETQJFXTULFLTX0TEHDAVFL7RQQHGZB8HXTCRIANI17TEOYMEJUUK8CN9SKN2NBC2XRVWE9H\"; Value: \"7811000000\")\n \"WCInstaller_20_.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WCInstaller_20_.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"ReleaseMutex failed:\" (Indicator: \"ReleaseMutex\"; File: \"WCInstaller _20_.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004472.00000001.135767.28B42000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex failed:\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004472.00000001.135767.2CA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004472.00000000.135628.450D0000.00000004.mdmp, 00000000-00004472.00000001.135767.450D0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"WCInstaller_20_.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\WCInstaller_20_.exe.log]- [targetUID: 00000000-00004472]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WCInstaller_20_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WCInstaller_20_.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4472)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"WCInstaller_20_.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$48","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\WCInstaller_20_.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"WCInstaller.Utils.ResourceLibUtils::FindResource(System.IntPtr,System.String,System.IntPtr) at ccacad16654fd59c45bd1a34ecb5c6ee-60002c0-ResourceLibUtils~ExtractStringResourceFromRcDataByName","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1\nContent-Type: application/json\nHost: flwadw.com\nContent-Length: 311\nConnection: Keep-Alive\" with payload::==> \"{\"Data\": {\"CampaignId\":null,\"InstallId\":\"5d7d8eda-ebd3-445e-961d-aa13c820cfc7\",\"Language\":\"en\",\"MachineId\":\"bfd7b2e9-d1a2-429c-8b47-d1857c2c0d93\",\"PartnerId\":null,\"OSVersion\":\"Microsoft Windows 10 Pro\",\"ProductVersion\":null,\"Message\":\"Another instance is already running.\",\"OsBit\":\"64\",\"CreateDate\":1790888538}}\" HTTP/1.1 200 OK\nDate: Thu\n 01 Oct 2026 21:02:22 GMT\nContent-Type: application/json; charset=utf-8\nTransfer-Encoding: chunked\nConnection: keep-alive\nVary: Accept-Encoding\ncf-cache-status: DYNAMIC\nServer: cloudflare\nCF-RAY: a43e686dddba78ff-SJC with response body ==>7B226D657373616765223A224576656E7420706572736973746564227D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.27.149 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"System Destruction","name":"Possibly checks for the presence of an adware detecting tool","description":"\"WebCompanion.exe\" (Indicator: \"webcompanion.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-46","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to start a new process with local system privileges","description":"ProcessAsUser::CreateProcessAsUser(System.IntPtr,System.String,System.String,SECURITY_ATTRIBUTES&,SECURITY_ATTRIBUTES&,System.Boolean,System.UInt32,System.IntPtr,System.String,STARTUPINFO&,PROCESS_INFORMATION&) at ccacad16654fd59c45bd1a34ecb5c6ee-6000027-ProcessAsUser~LaunchProcessAsUser","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.002","relevance":4,"id":"stream-98","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$49","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"889118066,7712,3181,,CreateCompatibleBitmap,Gdi32.dll,\"00:41:33.062\",RX=0,PX=0\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"55161117,7712,3118,,FindFirstFileW,kernel32.dll,\"00:41:31.843\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")\n Found reference to API \"36601776,7712,3118,,FindFirstFileW,kernel32.dll,\"00:41:31.796\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"389480970,7712,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:41:32.437\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"885219784,7712,111,,GetSystemMetrics,user32.dll,\"00:41:33.062\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")\n Found reference to API \"885334908,7712,111,,GetSystemMetrics,user32.dll,\"00:41:33.062\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007700.00000000.159724.F1940000.00000004.mdmp, 00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"4131884977,7712,113,,SystemParametersInfoW,user32.dll,\"00:41:37.343\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007700.00000001.159840.F1940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Possibly tries to hide a process launching it with different user credentials","description":"ProcessAsUser::CreateProcessAsUser(System.IntPtr,System.String,System.String,SECURITY_ATTRIBUTES&,SECURITY_ATTRIBUTES&,System.Boolean,System.UInt32,System.IntPtr,System.String,STARTUPINFO&,PROCESS_INFORMATION&) at ccacad16654fd59c45bd1a34ecb5c6ee-6000027-ProcessAsUser~LaunchProcessAsUser","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.002","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"intel_graph":{"map":{"Domain:flwadw.com":{"type":"Domain","value":"flwadw.com"},"File:5e8ed768e83711fd7ff6ac9f7b75ad2990f5bf4b90a4b968726b26ea3fecc3f7":{"type":"File","value":"5e8ed768e83711fd7ff6ac9f7b75ad2990f5bf4b90a4b968726b26ea3fecc3f7"},"File:964ad04b518314244b35e24b0e94c557f12a06410b888976f804faf43b05cd9a":{"type":"File","value":"964ad04b518314244b35e24b0e94c557f12a06410b888976f804faf43b05cd9a"},"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533":{"type":"File","value":"bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533"},"File:caa5080d18ff0b802ec71f37b9fb7bf0c351e20efa17cd3d7d3a91938dab2041":{"type":"File","value":"caa5080d18ff0b802ec71f37b9fb7bf0c351e20efa17cd3d7d3a91938dab2041"},"Ip:104.18.26.149":{"type":"Ip","value":"104.18.26.149"},"Ip:104.18.27.149":{"type":"Ip","value":"104.18.27.149"},"Url:/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1":{"type":"Url","value":"/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1"}},"chains":[{"id":"sandbox_network","root":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","edges":[{"edge_kind":"contacted_ip","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"Ip:104.18.27.149"},{"edge_kind":"contacted_ip","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"Ip:104.18.26.149"},{"edge_kind":"contacted_domain","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"Domain:flwadw.com"},{"edge_kind":"resolves_to","from_key":"Domain:flwadw.com","to_key":"Ip:104.18.27.149"},{"edge_kind":"contacted_url","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"Url:/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","edges":[{"edge_kind":"extracted","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"File:caa5080d18ff0b802ec71f37b9fb7bf0c351e20efa17cd3d7d3a91938dab2041"},{"edge_kind":"extracted","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"File:5e8ed768e83711fd7ff6ac9f7b75ad2990f5bf4b90a4b968726b26ea3fecc3f7"},{"edge_kind":"extracted","from_key":"File:bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","to_key":"File:964ad04b518314244b35e24b0e94c557f12a06410b888976f804faf43b05cd9a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6abed7f9269683630f095139","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":76,"malware_family":"PUP.Generic","submit_name":"WCInstaller (20).exe","analysis_start_time":"2026-10-01T22:00:26+00:00","indicators_count":{"informative":191,"suspicious":36,"malicious":0},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6abeca3b8cfd9a66570ce944","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":76,"malware_family":"PUP.Generic","submit_name":"WCInstaller (20).exe","analysis_start_time":"2026-10-01T21:01:48+00:00","indicators_count":{"informative":185,"suspicious":37,"malicious":0},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.18.27.149","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"address":"104.18.26.149","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"dns_resolutions":[{"domain":"flwadw.com","address":"104.18.27.149","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"http_requests":[{"host":"flwadw.com","host_ip":"104.18.27.149:443","url":"/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1\nContent-Type: application/json\nHost: flwadw.com\nContent-Length: 311\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}],"processes":[{"pid":4472,"ppid":0,"name":"WCInstaller_20_.exe","command_line":"","sha256":"bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533","normalized_path":"C:\\WCInstaller_20_.exe","uid":"00000000-00004472","icon":"$4b"}],"all_imported_dlls":["ntdll.dll","shlwapi.dll","wbemprox.dll","webengine4.dll","dhcpcsvc.dll","gpapi.dll","mscoree.dll","ucrtbase.dll","vcruntime140_clr0400.dll","rsaenh.dll","PresentationCore.ni.dll","PresentationNative_v0400.dll","clrjit.dll","dnsapi.dll","sechost.dll","System.Configuration.ni.dll","msvcp140.dll","IPHLPAPI.DLL","msvcrt.dll","ucrtbase_clr0400.dll","uxtheme.dll","WindowsBase.ni.dll","cfgmgr32.dll","VxSSL64.dll","TextInputFramework.dll","advapi32.dll","psapi.dll","bcrypt.dll","System.Web.dll","schannel.dll","crypt32.dll","msctf.dll","CoreUIComponents.dll","gdi32full.dll","win32u.dll","System.Core.ni.dll","rasman.dll","winhttp.dll","kernel32.dll","combase.dll","DWrite.dll","shell32.dll","SHCore.dll","wbemsvc.dll","OnDemandConnRouteHelper.dll","imm32.dll","msvcp140_clr0400.dll","wbemcomn.dll","clr.dll","cryptsp.dll","PresentationFramework.ni.dll","System.Xml.ni.dll","fltLib.dll","vcruntime140.dll","clbcatq.dll","WMINet_Utils.dll","mswsock.dll","winnsi.dll","msasn1.dll","ncryptsslp.dll","dwmapi.dll","KernelBase.dll","user32.dll","ntmarta.dll","userenv.dll","oleaut32.dll","ws2_32.dll","bcryptprimitives.dll","kernel.appcore.dll","wpfgfx_v0400.dll","System.Management.ni.dll","rasapi32.dll","dhcpcsvc6.dll","rasadhlp.dll","sspicli.dll","mscorlib.ni.dll","ole32.dll","cryptbase.dll","powrprof.dll","rtutils.dll","FWPUCLNT.DLL","ncrypt.dll","CoreMessaging.dll","mscoreei.dll","msvcp_win.dll","version.dll","System.Xaml.ni.dll","windows.storage.dll","profapi.dll","wmiutils.dll","nsi.dll","rpcrt4.dll","System.ni.dll","vcruntime140_1.dll","fastprox.dll","secur32.dll","mskeyprotect.dll","ntasn1.dll","WinTypes.dll","gdi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Statistics.txt","sha256":"caa5080d18ff0b802ec71f37b9fb7bf0c351e20efa17cd3d7d3a91938dab2041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"WCInstaller_20_.exe.log","sha256":"5e8ed768e83711fd7ff6ac9f7b75ad2990f5bf4b90a4b968726b26ea3fecc3f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"WcInstaller.log","sha256":"964ad04b518314244b35e24b0e94c557f12a06410b888976f804faf43b05cd9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"%ALLUSERSPROFILE%\\Lavasoft\\Web Companion\\Options\\Statistics.txt","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"%TEMP%\\WcInstaller.log","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\WCInstaller_20_.exe.log","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\LAVASOFT\\WEB COMPANION\\","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\LAVASOFT\\","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4472:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AdwareWCInstaller","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"Local\\SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"SM0:4472:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"}]},{"name":"AdwareWCInstaller","sources":[{"report_type":"sandbox","report_id":"6abeca3b8cfd9a66570ce944"},{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7700:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"SM0:7700:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"Local\\SM0:7700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]},{"name":"SM0:7700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abed7f9269683630f095139"}]}]}},"report_ids":{"sandbox_job_ids":["6abed7f9269683630f095139","6abeca3b8cfd9a66570ce944"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious PUP.Generic Sample bb7c648791d9… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample bb7c648791d9…. Malware family: PUP.Generic. Threat score 76/100. 1/27 AV engines flagged this file. 0 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533"}],["$","meta","4",{"property":"og:title","content":"Suspicious PUP.Generic Sample bb7c648791d9… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample bb7c648791d9…. Malware family: PUP.Generic. Threat score 76/100. 1/27 AV engines flagged this file. 0 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bb7c648791d9377db31a2205a790bec310d7ae067515f763a2b7ed3e7e7a7533"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious PUP.Generic Sample bb7c648791d9… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample bb7c648791d9…. Malware family: PUP.Generic. Threat score 76/100. 1/27 AV engines flagged this file. 0 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]