23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:Tee1,"SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" at 00000000-00002492-00000046-82019 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" at 00000000-00002492-00000046-86432 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00002492-00000046-767616 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00002492-00000046-771178 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00002492-00000046-801527 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" at 00000000-00002492-00000046-1449223 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" at 00000000-00002492-00000046-1454416 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00002492-00000046-1872718 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00002492-00000046-2030629 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00002492-00000046-2036547 "SecretDisk.exe" queries volume information of "C:\SecretDisk.exe" at 00000000-00002492-00000046-13242458056805892 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00002492-00000046-13242458056882816 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00002492-00000046-13242458056887777 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00002492-00000046-13242458056936137 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00002492-00000046-13242458056941520 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00002492-00000046-13242458057031711 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00002492-00000046-13242458057036260 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" at 00000000-00002492-00000046-13242458057153931 "SecretDisk.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" at 00000000-00002492-00000046-1324245805716476625:T66d,"iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179"; Key: "BLOB") "iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\590D2D7D884F402E617EA562321765CF17D894E9"; Key: "BLOB") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4"; Key: "BLOB") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A"; Key: "BLOB") "iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "iexplore.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\36B12B49F9819ED74C9EBC380FC6568F5DACB2F7"; Key: "BLOB") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\47BEABC922EAE80E78783462A79F45C254FDE68B"; Key: "BLOB")26:T489,"dismhost.exe.61545D9C.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows" "urlblockindex_1_.bin" has type "data" "desktop.ini" has type "empty" "7CS48IUV.txt" has type "ASCII text" "6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442" has type "data" "XKFF4DPS.txt" has type "ASCII text" "3O1NEN4B.txt" has type "ASCII text" "0OAU6T5I.txt" has type "ASCII text" "NPWCHAM7.txt" has type "ASCII text" "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data" "ver81F3.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 4817 bytes 1 file" "644B8874112055B5E195ECB0E8F243A4" has type "data" "dberr.txt" has type "ASCII text with CRLF line terminators" "httpErrorPagesScripts_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators" "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" has type "data" "M8L6TN0Q.txt" has type "ASCII text"27:T983c,Heuristic match: "SecretDisk.My" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "https://sectigo.com/CPS0C" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://sectigo.com/CPS0D" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" Pattern match: "https://privacyroot.com/apps/scripts/" Heuristic match: "uframework-web.pl" Pattern match: "http://www.saprykin.com/proot-uf-server-down.txt" Heuristic match: "uframework-pc.pl" Heuristic match: "crl.identrust.com" Heuristic match: "GET /DSTROOTCAX3CRL.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.identrust.com" Heuristic match: "ocsp.sectigo.com" Heuristic match: "privacyroot.com" Heuristic match: "x1.c.lencr.org" Pattern match: "https://privacyroot.com/apps/scripts/apps-sede-pinrecovery.pl?pin=" Pattern match: "https://privacyroot.com/apps/scripts/apps-sede-passverification.pl?eml=" Heuristic match: "uframework-errors.pl" Pattern match: "https://privacyroot.com/apps/scripts/uframework-web.pl?scn=sede&version=2106.00&fipr=b4ea54875f02055a46cd431022556adf&pcid=509ccbbdaec9970ae4f1b7940b08900e&location=site&iso2=en&lang_sede=" Pattern match: "www.msn.com/" Heuristic match: "CatalogDB: 8:19:47 PM 12/11/2017: DONE Adding Catalog File (16ms): oem3.CAT" Heuristic match: "CatalogDB: 8:19:47 PM 12/11/2017: DONE Adding Catalog File (0ms): oem3.CAT" Heuristic match: "CatalogDB: 8:19:48 PM 12/11/2017: DONE Adding Catalog File (16ms): oem3.CAT" Heuristic match: "CatalogDB: 8:20:05 PM 12/11/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 8:20:06 PM 12/11/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 9:34:47 AM 2/20/2018: DONE Adding Catalog File (141ms): oem5.CAT" Heuristic match: "CatalogDB: 9:34:48 AM 2/20/2018: DONE Adding Catalog File (0ms): oem5.CAT" Heuristic match: "CatalogDB: 9:35:05 AM 2/20/2018: DONE Adding Catalog File (0ms): oem6.CAT" Heuristic match: "CatalogDB: 9:35:05 AM 2/20/2018: DONE Adding Catalog File (16ms): oem6.CAT" Heuristic match: "CatalogDB: 11:31:20 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.2.cat" Heuristic match: "CatalogDB: 11:31:20 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_for_KB2952664_SP1~31bf3856ad364e35~amd64~~6.1.24.2.cat" Heuristic match: "CatalogDB: 11:31:20 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_1_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.2.cat" Heuristic match: "CatalogDB: 11:31:21 AM 2/20/2018: DONE Adding Catalog File (187ms): Package_3_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.2.cat" Heuristic match: "CatalogDB: 11:31:54 AM 2/20/2018: DONE Adding Catalog File (63ms): Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.23964.1.2.cat" Heuristic match: "CatalogDB: 11:31:54 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_for_KB4054518_RTM~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:55 AM 2/20/2018: DONE Adding Catalog File (188ms): Package_2_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:55 AM 2/20/2018: DONE Adding Catalog File (250ms): Package_16_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:55 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_121_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:55 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_111_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:55 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_for_KB4054518_SP1~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:56 AM 2/20/2018: DONE Adding Catalog File (313ms): Package_131_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:56 AM 2/20/2018: DONE Adding Catalog File (203ms): Package_132_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:56 AM 2/20/2018: DONE Adding Catalog File (47ms): Package_133_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:58 AM 2/20/2018: DONE Adding Catalog File (1593ms): Package_134_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:58 AM 2/20/2018: DONE Adding Catalog File (141ms): Package_135_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:58 AM 2/20/2018: DONE Adding Catalog File (156ms): Package_136_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:31:58 AM 2/20/2018: DONE Adding Catalog File (110ms): Package_137_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (6187ms): Package_162_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_163_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_164_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_166_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_167_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (78ms): Package_168_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:04 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_204_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:05 AM 2/20/2018: DONE Adding Catalog File (360ms): Package_205_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (937ms): Package_206_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (94ms): Package_207_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_208_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (94ms): Package_209_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_244_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_289_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_290_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_292_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (156ms): Package_293_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_294_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_295_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_296_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_297_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_298_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_299_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (63ms): Package_300_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (62ms): Package_301_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_339_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_362_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_343_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_363_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_344_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_364_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_345_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_365_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_346_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_366_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_347_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_367_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_348_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_368_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_349_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:06 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_369_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_350_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_370_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_351_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_371_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_352_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_372_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_353_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_373_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_354_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_374_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_355_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_375_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_356_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_376_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_357_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_377_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_358_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_378_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_359_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_379_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_360_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_380_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_361_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (63ms): Package_384_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_385_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_386_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_387_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_452_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_453_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_454_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_455_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:07 AM 2/20/2018: DONE Adding Catalog File (141ms): Package_456_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (719ms): Package_495_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_496_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_497_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_498_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (203ms): Package_499_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:08 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_500_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (890ms): Package_501_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_502_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_525_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_526_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_527_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_563_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:09 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_564_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (391ms): Package_565_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_603_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_604_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (62ms): Package_605_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_683_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_684_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_764_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_765_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_766_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_767_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (63ms): Package_768_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_769_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_807_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_811_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_812_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_849_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_875_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_851_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_878_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_854_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_879_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_855_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (15ms): Package_880_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_856_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_881_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_857_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_882_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (32ms): Package_858_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_883_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_859_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_884_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_860_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_885_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_861_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_886_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_862_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_887_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (16ms): Package_863_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_888_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_864_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_889_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_865_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_890_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_866_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_891_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_867_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_892_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_868_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_893_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_869_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_894_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_870_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_895_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_871_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_961_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_962_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (31ms): Package_1200_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1207_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1237_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (94ms): Package_1238_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1239_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1240_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1241_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1242_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 11:32:10 AM 2/20/2018: DONE Adding Catalog File (0ms): Package_1243_for_KB4054518~31bf3856ad364e35~amd64~~6.1.1.2.cat" Heuristic match: "CatalogDB: 1:47:43 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "CatalogDB: 1:47:43 PM 3/15/2018: DONE Adding Catalog File (47ms): Package_for_KB2952664_SP1~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "CatalogDB: 1:47:43 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_1_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "CatalogDB: 1:47:43 PM 3/15/2018: DONE Adding Catalog File (219ms): Package_3_for_KB2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB2574819_SP1~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (15ms): Package_28_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (172ms): Package_29_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (203ms): Package_31_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_55_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (109ms): Package_54_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:22:54 PM 3/15/2018: DONE Adding Catalog File (110ms): Package_83_for_KB2574819~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:02 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:02 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB3080079_SP1~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:02 PM 3/15/2018: DONE Adding Catalog File (422ms): Package_51_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:03 PM 3/15/2018: DONE Adding Catalog File (281ms): Package_52_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (1125ms): Package_53_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (94ms): Package_54_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_55_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (188ms): Package_80_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (188ms): Package_81_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:04 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_128_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (172ms): Package_120_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (15ms): Package_129_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (203ms): Package_121_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_130_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (47ms): Package_122_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_131_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_123_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_132_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_124_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_133_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (360ms): Package_125_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:05 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_134_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:06 PM 3/15/2018: DONE Adding Catalog File (47ms): Package_126_for_KB3080079~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:15 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB3102429~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:15 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB3102429_SP1~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:15 PM 3/15/2018: DONE Adding Catalog File (297ms): Package_39_for_KB3102429~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:16 PM 3/15/2018: DONE Adding Catalog File (953ms): Package_40_for_KB3102429~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:16 PM 3/15/2018: DONE Adding Catalog File (141ms): Package_41_for_KB3102429~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:16 PM 3/15/2018: DONE Adding Catalog File (93ms): Package_117_for_KB3102429~31bf3856ad364e35~amd64~~6.1.2.0.cat" Heuristic match: "CatalogDB: 2:23:21 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB2857650~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:21 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_for_KB2857650_SP1~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:21 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_1_for_KB2857650~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:23:21 PM 3/15/2018: DONE Adding Catalog File (0ms): Package_8_for_KB2857650~31bf3856ad364e35~amd64~~6.1.1.1.cat" Heuristic match: "CatalogDB: 2:24:10 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-WinIP-Package-TopLevel~31bf3856ad364e35~amd64~~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:10 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-WinIP-Package~31bf3856ad364e35~amd64~~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:10 PM 3/15/2018: DONE Adding Catalog File (47ms): Microsoft-Windows-RemoteDesktopClient-WinIP-Package~31bf3856ad364e35~amd64~~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:11 PM 3/15/2018: DONE Adding Catalog File (235ms): Microsoft-Windows-RemoteDesktopService-WinIP-Package~31bf3856ad364e35~amd64~~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:11 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-WinIP-Package-MiniLP~31bf3856ad364e35~amd64~en-US~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:11 PM 3/15/2018: DONE Adding Catalog File (15ms): Microsoft-Windows-RDP-WinIP-Package~31bf3856ad364e35~amd64~en-US~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:11 PM 3/15/2018: DONE Adding Catalog File (313ms): Microsoft-Windows-RemoteDesktopClient-WinIP-Package~31bf3856ad364e35~amd64~en-US~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:11 PM 3/15/2018: DONE Adding Catalog File (187ms): Microsoft-Windows-RemoteDesktopService-WinIP-Package~31bf3856ad364e35~amd64~en-US~7.1.7601.16398.cat" Heuristic match: "CatalogDB: 2:24:30 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-BlueIP-Package-TopLevel~31bf3856ad364e35~amd64~~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 2:24:30 PM 3/15/2018: DONE Adding Catalog File (31ms): Microsoft-Windows-RDP-BlueIP-Package~31bf3856ad364e35~amd64~~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 2:24:30 PM 3/15/2018: DONE Adding Catalog File (562ms): Microsoft-Windows-RemoteDesktopClient-BlueIP-Package~31bf3856ad364e35~amd64~~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 2:24:30 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-BlueIP-Package-MiniLP~31bf3856ad364e35~amd64~en-US~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 2:24:30 PM 3/15/2018: DONE Adding Catalog File (0ms): Microsoft-Windows-RDP-BlueIP-Package~31bf3856ad364e35~amd64~en-US~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 2:24:31 PM 3/15/2018: DONE Adding Catalog File (250ms): Microsoft-Windows-RemoteDesktopClient-BlueIP-Package~31bf3856ad364e35~amd64~en-US~7.2.7601.16415.cat" Heuristic match: "CatalogDB: 11:56:48 AM 8/7/2018: DONE Adding Catalog File (422ms): oem7.CAT" Heuristic match: "CatalogDB: 11:56:48 AM 8/7/2018: DONE Adding Catalog File (0ms): oem7.CAT" Heuristic match: "CatalogDB: 11:56:49 AM 8/7/2018: DONE Adding Catalog File (94ms): oem7.CAT" Heuristic match: "CatalogDB: 11:56:55 AM 8/7/2018: DONE Adding Catalog File (157ms): oem8.CAT" Heuristic match: "CatalogDB: 11:56:56 AM 8/7/2018: DONE Adding Catalog File (0ms): oem8.CAT" Heuristic match: "CatalogDB: 11:51:27 PM 8/7/2018: DONE Adding Catalog File (15ms): oem7.CAT" Heuristic match: "CatalogDB: 11:51:29 PM 8/7/2018: DONE Adding Catalog File (16ms): oem7.CAT" Heuristic match: "CatalogDB: 11:51:29 PM 8/7/2018: DONE Adding Catalog File (0ms): oem8.CAT" Heuristic match: "CatalogDB: 11:51:29 PM 8/7/2018: DONE Adding Catalog File (16ms): oem8.CAT" Heuristic match: "CatalogDB: 1:30:50 PM 1/30/2019: DONE Adding Catalog File (140ms): oem9.CAT" Heuristic match: "CatalogDB: 1:30:50 PM 1/30/2019: DONE Adding Catalog File (0ms): oem9.CAT" Heuristic match: "CatalogDB: 1:30:51 PM 1/30/2019: DONE Adding Catalog File (110ms): oem9.CAT" Heuristic match: "CatalogDB: 1:30:56 PM 1/30/2019: DONE Adding Catalog File (15ms): oem10.CAT" Heuristic match: "CatalogDB: 1:30:56 PM 1/30/2019: DONE Adding Catalog File (0ms): oem10.CAT" Heuristic match: "CatalogDB: 1:30:57 PM 1/30/2019: DONE Adding Catalog File (0ms): oem10.CAT" Heuristic match: "CatalogDB: 12:20:07 PM 2/14/2020: DONE Adding Catalog File (469ms): oem11.CAT" Heuristic match: "CatalogDB: 12:20:07 PM 2/14/2020: DONE Adding Catalog File (0ms): oem11.CAT" Heuristic match: "CatalogDB: 12:20:08 PM 2/14/2020: DONE Adding Catalog File (0ms): oem11.CAT" Heuristic match: "CatalogDB: 12:20:15 PM 2/14/2020: DONE Adding Catalog File (93ms): oem12.CAT" Heuristic match: "CatalogDB: 12:20:15 PM 2/14/2020: DONE Adding Catalog File (0ms): oem12.CAT" Heuristic match: "CatalogDB: 12:20:16 PM 2/14/2020: DONE Adding Catalog File (16ms): oem12.CAT" Heuristic match: "CatalogDB: 12:20:16 PM 2/14/2020: DONE Adding Catalog File (15ms): VBoxMouse.cat" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=401352" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=513071" Pattern match: "https://aka.ms/FlashEOLUpdate"28:T854,"iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "IEXPLORE.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")29:T13fc,Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "1.6.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IPs "0.0.0.0" "0.0.0.0" found in string ""2a:T892,"SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F264E" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F26ED" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F29CC" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F25EB" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE8F2C8B" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE8F2CCB" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F28CA" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F26A3" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEE8F2B83" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEE8F2BA0" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEE8F2BC0" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE8F2C1B" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE8F2C5B" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "79929da7b46d0000" to virtual address "0xEF0BFA70" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F2533" (part of module "CLR.DLL") "SecretDisk.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE8F2570" (part of module "CLR.DLL") "iexplore.exe" wrote bytes "b06181f3fe070000" to virtual address "0xFDC255C0" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "406881f3fe070000" to virtual address "0xFD6BBEA8" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "50077ff3fe070000" to virtual address "0xFE521ED8" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "401c7df3fe070000" to virtual address "0xFDC25348" (part of module "SHLWAPI.DLL")2b:T4e1,"SecretDisk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "SecretDisk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "SecretDisk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SecretDisk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecretDisk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "iexplore.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "iexplore.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "iexplore.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "iexplore.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "IEXPLORE.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "IEXPLORE.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "IEXPLORE.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "IEXPLORE.EXE" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "IEXPLORE.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")2c:T720,Found malicious artifacts related to "205.196.223.84": ... URL: https://privacyroot.com/apps/freeware/tools-en-about-wipe-.php (AV positives: 1/89 scanned on 09/20/2021 11:29:32) URL: http://privacyroot.com/software/setups/setup_prevent_restore.exe (AV positives: 1/89 scanned on 09/18/2021 11:22:13) URL: http://privacyroot.com/apps-exe/wipe/setup_wipe.exe (AV positives: 1/89 scanned on 09/16/2021 11:55:10) URL: http://privacyroot.com/apps-exe/wfds/setup_wfds.exe (AV positives: 1/89 scanned on 09/13/2021 20:41:21) URL: https://privacyroot.com/apps-exe/wfds/setup_wfds.exe (AV positives: 1/89 scanned on 09/13/2021 18:00:23) File SHA256: 37ccdb6a08108f382aa7c61a25e8ede8526b0e1d4014d0d9ce71f97abe3c66e7 (AV positives: 1/76 scanned on 12/06/2020 03:34:48) File SHA256: 917a1168a942da32f55371e9770b7b7c7a8febcf5a8ccc0576e9ebf90c83b089 (AV positives: 1/76 scanned on 12/04/2020 05:03:53) File SHA256: d9d72dbe08aa52e77d7f95c4bab532396305c25364dbe2619cc3e4a54d2e180b (AV positives: 1/75 scanned on 10/02/2020 02:39:27) File SHA256: 458ce2ac4a0359ada0f7f3e189fef2589da5884673a409eeb4aaa61c439f3dbb (AV positives: 1/74 scanned on 03/16/2020 04:10:38) File SHA256: d889f8b9d9c0768ef78d8ec21e53e83b72a891d749033cd1e79ab6dc71e22302 (Date: 12/05/2019 05:07:21) File SHA256: eb450e68466cb2a2c901a48b0cfb701937ff2aa34e47f91431cfe0743401472a (Date: 04/15/2019 09:58:47) File SHA256: 9c6e6f4e6bb9b11b879a927b7e3b4878a276baee8047b4f11f1bcfd220310cdd (AV positives: 1/67 scanned on 04/02/2019 07:44:48) File SHA256: 5c884f00c4e573c2ae8dc0b4ea9ae34f0ca594138cbb147128a04897da256882 (Date: 03/07/2017 08:51:57) File SHA256: eacce712bc5cd4357639eea404fd8cda579c0b6669fea7d3446c8697647dc547 (Date: 03/13/2016 07:36:09) File SHA256: 96e444c3765bf4b511178fb593047bf0fd5a99d677f1298830e7e69042cc44b7 (Date: 03/13/2016 07:35:07)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////+IiIiIiIiIiIiIiIiIiP/47u7u7u7u7uZmZmZmZmaP+O7u7u7u7u5mZmZmZmZmj/ju7u7u7u7mZmZmZmZmZo/47u7u7u7ubuZmZmZmZmaP+O7u7u7u7v/4ZmZmZmZmj/ju7u7u7o////hmZmZmZo/47u7u7uj/7uj/hmZmZmaP+O7u7u6Pjo/47/hmZmZmj/ju7u7u+O////7/ZmZmZo/47u7u7/7/////74ZmZmaP+O7u7o/v/////4j+ZmZmj/ju7u7/j/9mbv/++GZmZo/47u7u+P//5mj/+I9mZmaP+O7u6P7//4Zv//+P5mZmj/ju7u/+///maP//74ZmZo/47u7viP//Zm7//++GZm6P+O7u74j//+Zo///v9mbuj/ju7u+I///4j///j/Zu7o/47u7vjuj/////jo/27u6P+O7u6P/46P//jo//ju7uj/ju7u7u//6P/o/47u7u7o/47u7u7u7/juj/7u7u7u6P+O7u7u7u6Pj/ju7u7u7uj/ju7u7u7u6P/u7u7u7u7o/47u7u7u7u7u7u7u7u7u6P+O7u7u7u7u7u7u7u7u7uj/ju7u7u7u7u7u7u7u7u7o/47u7u7u7u7u7u7u7u7u6P/4iIiIiIiIiIiIiIiIiI//////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////+IiIiIiIiIiIiIiIiIiP/47u7u7u7u7uZmZmZmZmaP+O7u7u7u7u5mZmZmZmZmj/ju7u7u7u7mZmZmZmZmZo/47u7u7u7ubuZmZmZmZmaP+O7u7u7u7v/4ZmZmZmZmj/ju7u7u7o////hmZmZmZo/47u7u7uj/7uj/hmZmZmaP+O7u7u6Pjo/47/hmZmZmj/ju7u7u+O////7/ZmZmZo/47u7u7/7/////74ZmZmaP+O7u7o/v/////4j+ZmZmj/ju7u7/j/9mbv/++GZmZo/47u7u+P//5mj/+I9mZmaP+O7u6P7//4Zv//+P5mZmj/ju7u/+///maP//74ZmZo/47u7viP//Zm7//++GZm6P+O7u74j//+Zo///v9mbuj/ju7u+I///4j///j/Zu7o/47u7vjuj/////jo/27u6P+O7u6P/46P//jo//ju7uj/ju7u7u//6P/o/47u7u7o/47u7u7u7/juj/7u7u7u6P+O7u7u7u6Pj/ju7u7u7uj/ju7u7u7u6P/u7u7u7u7o/47u7u7u7u7u7u7u7u7u6P+O7u7u7u7u7u7u7u7u7uj/ju7u7u7u7u7u7u7u7u7o/47u7u7u7u7u7u7u7u7u6P/4iIiIiIiIiIiIiIiIiI//////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample c1b95d3ce125… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample c1b95d3ce125…. Threat score 0/100. 0/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"SecretDisk.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"assembly\",\"executable\"],\"identifier\":\"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":3,\"suspicious\":16},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790545479654,"unified_at":"2026-09-27T21:44:39.654Z","metadata":{"hashes":{"sha256":"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb","sha1":"23e343c26017c9f2b733e788b457aaca12267392","md5":"41ba5fbe55399fe20d3f56c4c5d8b351","sha512":"709ac2f98cfbff62f9b3b0e01dad21c4a00ec339c6c74d36f8423bbecc6fe7684fba368fa37b152c1added7e03074a840d72a39f2a1fd3b7e42bae8a0a49116f","ssdeep":"3072:e03k+ZbT79U6m122BvKcxIbdpoEFr5xCa5Z5XM9hMNL7MP9vpFmMG3Z6yE9YqlZ3:e03k+dK6m8GxIbboinFM9hxe03k1U+Hi","ssdeep_chunks":["3072:e03k+Zb","3072:03k+ZbT","3072:3k+ZbT7","3072:k+ZbT79","3072:+ZbT79U","3072:ZbT79U6","3072:bT79U6m","3072:T79U6m1","3072:79U6m12","3072:9U6m122","3072:U6m122B","3072:6m122Bv","3072:m122BvK","3072:122BvKc","3072:22BvKcx","3072:2BvKcxI","3072:BvKcxIb","3072:vKcxIbd","3072:KcxIbdp","3072:cxIbdpo","3072:xIbdpoE","3072:IbdpoEF","3072:bdpoEFr","3072:dpoEFr5","3072:poEFr5x","3072:oEFr5xC","3072:EFr5xCa","3072:Fr5xCa5","3072:r5xCa5Z","3072:5xCa5Z5","3072:xCa5Z5X","3072:Ca5Z5XM","3072:a5Z5XM9","3072:5Z5XM9h","3072:Z5XM9hM","3072:5XM9hMN","3072:XM9hMNL","3072:M9hMNL7","3072:9hMNL7M","3072:hMNL7MP","3072:MNL7MP9","3072:NL7MP9v","3072:L7MP9vp","3072:7MP9vpF","3072:MP9vpFm","3072:P9vpFmM","3072:9vpFmMG","3072:vpFmMG3","3072:pFmMG3Z","3072:FmMG3Z6","3072:mMG3Z6y","3072:MG3Z6yE","3072:G3Z6yE9","3072:3Z6yE9Y","3072:Z6yE9Yq","3072:6yE9Yql","3072:yE9YqlZ","3072:E9YqlZ3","6144:e03k+Zb","6144:03k+ZbT","6144:3k+ZbT7","6144:k+ZbT79","6144:+ZbT79U","6144:ZbT79U6","6144:bT79U6m","6144:T79U6m1","6144:79U6m12","6144:9U6m122","6144:U6m122B","6144:6m122Bv","6144:m122BvK","6144:122BvKc","6144:22BvKcx","6144:2BvKcxI","6144:BvKcxIb","6144:vKcxIbd","6144:KcxIbdp","6144:cxIbdpo","6144:xIbdpoE","6144:IbdpoEF","6144:bdpoEFr","6144:dpoEFr5","6144:poEFr5x","6144:oEFr5xC","6144:EFr5xCa","6144:Fr5xCa5","6144:r5xCa5Z","6144:5xCa5Z5","6144:xCa5Z5X","6144:Ca5Z5XM","6144:a5Z5XM9","6144:5Z5XM9h","6144:Z5XM9hM","6144:5XM9hMN","6144:XM9hMNL","6144:M9hMNL7","6144:9hMNL7M","6144:hMNL7MP","6144:MNL7MP9","6144:NL7MP9v","6144:L7MP9vp","6144:7MP9vpF","6144:MP9vpFm","6144:P9vpFmM","6144:9vpFmMG","6144:vpFmMG3","6144:pFmMG3Z","6144:FmMG3Z6","6144:mMG3Z6y","6144:MG3Z6yE","6144:G3Z6yE9","6144:3Z6yE9Y","6144:Z6yE9Yq","6144:6yE9Yql","6144:yE9YqlZ","6144:E9YqlZ3","3072:e03k+dK","3072:03k+dK6","3072:3k+dK6m","3072:k+dK6m8","3072:+dK6m8G","3072:dK6m8Gx","3072:K6m8GxI","3072:6m8GxIb","3072:m8GxIbb","3072:8GxIbbo","3072:GxIbboi","3072:xIbboin","3072:IbboinF","3072:bboinFM","3072:boinFM9","3072:oinFM9h","3072:inFM9hx","3072:nFM9hxe","3072:FM9hxe0","3072:M9hxe03","3072:9hxe03k","3072:hxe03k1","3072:xe03k1U","3072:e03k1U+","3072:03k1U+H","3072:3k1U+Hi"]},"file_info":{"file_name":"SecretDisk.exe","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":290072,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1632918469000,"last_seen":1679571351000,"last_multi_scan":1679571351000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":29,"suspicious_count":16,"malicious_count":3,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo at 41ba5fbe55399fe20d3f56c4c5d8b351-60001aa-UF~GetProgramFileVersion","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"SecretDisk.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\")\n \"SecretDisk.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"APPENDPATH\")\n \"SecretDisk.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"USESHORTNAME\")\n \"IEXPLORE.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"IEXPLORE.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/66 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\"; Key: \"\")\n \"IEXPLORE.EXE\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"IEXPLORE.EXE\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl.identrust.com\"\n \"ocsp.sectigo.com\"\n \"privacyroot.com\"\n \"x1.c.lencr.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"205.196.223.84:443\"\n \"23.63.75.153:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\Apps\\Apps-sede\\SEDE\\obj\\Debug\\SecretDisk.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DF9E917E5B2D460464.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFFA4000B3DC290AF2.TMP\"\n \"IEXPLORE.EXE\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IESQMMUTEX_0_519\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"IsoScope_140_IESQMMUTEX_0_303\"\n \"IsoScope_140_IESQMMUTEX_0_331\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"IsoScope_140_IE_EarlyTabStart_0x14c_Mutex\"\n \"IsoScope_140_ConnHashTable<320>_HashTable_Mutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_320\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"IsoScope_140_IESQMMUTEX_0_519\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"UpdatingNewTabPageData\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_320\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.61545D9C.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /DSTROOTCAX3CRL.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.identrust.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00000320)\n Launches browser \"IEXPLORE.EXE\" (UID: 00000000-00001112)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"SecretDisk.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at ED2F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00000000-00000320) was launched with modified environment variables: \"Path\"\n Process \"dismhost.exe\" (UID: 00000000-00002520) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"\n Process \"dismhost.exe\" (UID: 00000000-00002520) was launched with missing environment variables: \"LOGONSERVER, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Reference url in command line","description":"Process \"iexplore.exe\" with commandline \"https://privacyroot.com/apps/scripts/uframework-web.pl?scn=sede&version=2106.00&fipr=b4ea54875f02055a46cd431022556adf&pcid=509ccbbdaec9970ae4f1b7940b08900e&location=site&iso2=en&lang_sede=\" (UID: 00000000-00000320)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"SecretDisk.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://privacyroot.com/apps/scripts/uframework-web.pl?scn=sede& ...\" (UID: 00000000-00000320)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:320 CREDAT:275457 /prefetch:2\" (UID: 00000000-00001112)\n Spawned process \"dismhost.exe\" with commandline \"{79D75D60-19DA-4ACB-8999-EA3C4B2B37A9}\" (UID: 00000000-00002520)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://privacyroot.com/apps/scripts/uframework-web.pl?scn=sede& ...\" (UID: 00000000-00000320)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:320 CREDAT:275457 /prefetch:2\" (UID: 00000000-00001112)\n Spawned process \"dismhost.exe\" with commandline \"{79D75D60-19DA-4ACB-8999-EA3C4B2B37A9}\" (UID: 00000000-00002520)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 8A:D2:0F:E0:7A:0B:6B:39:2A:91:AB:B1:C4:55:42:92:21:0F:46:8A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 02:D6:5B:95:E2:83:70:C1:57:00:95:FA:88:F9:23:DD:93:7F:AD:8F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo RSA Time Stamping CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 95:11:37:10:1D:88:2F:31:BD:51:3F:94:9A:DA:4C:68:AD:8C:08:F5; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"SecretDisk.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"SecretDisk.exe\" touched file \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\dc6f17d3b5a947b693fa471cfd23bbc8\\Accessibility.ni.dll.aux\"\n \"SecretDisk.exe\" touched file \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SecretDisk.exe\" opened \"\\Device\\KsecDD\"\n \"dismhost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb.bin\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"SecretDisk.exe\" at 00000000-00002492-00000033-248695\n \"dismhost.exe\" at 00000000-00002520-00000033-1334460","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"SecretDisk.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"Product=Win32_BaseBoard~Product~VirtualBox|\" (Indicator: \"virtualbox\")\n \"vboxvideo.inf\" (Indicator: \"vbox\")\n \"2021-09-29 12:36:27, Error DISM DISM Driver Manager: PID=2520 Failed opening driver package for x86: INF Name='%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxguest.inf_amd64_neutral_54dffbe2252403f6\\vboxguest.inf' - CDriverPackage::OpenDm\" (Indicator: \"vbox\")\n \"2021-09-29 12:36:27, Error DISM DISM Driver Manager: PID=2520 Failed opening driver package for x86: INF Name='%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxguest.inf_amd64_neutral_54dffbe2252403f6\\vboxguest.inf' - CDriverPackage::OpenDm\" (Indicator: \"vboxguest\")\n \"CatalogDB: 12:20:16 PM 2/14/2020: DONE Adding Catalog File (15ms): VBoxMouse.cat\" (Indicator: \"vbox\")\n \"CatalogDB: 12:20:16 PM 2/14/2020: DONE Adding Catalog File (15ms): VBoxMouse.cat\" (Indicator: \"vboxmouse\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"SecretDisk.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"IEXPLORE.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"dismhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/89 reputation engines marked \"http://crt.sectigo.com\" as malicious (3% detection rate)\n 2/89 reputation engines marked \"http://crl.sectigo.com\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"SecretDisk.exe\" read file \"%ALLUSERSPROFILE%\\WindowsHardwareTelemetry.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"dismhost.exe.61545D9C.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$29","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 205.196.223.84 on port 443 is sent without HTTP header\n TCP traffic to 23.63.75.153 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb.bin\" claimed CRC 292566 while the actual is CRC 292822","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetVersionExA\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetTickCount\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n FindResourceExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SecretDisk.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1468)\n \"SecretDisk.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1468)\n \"SecretDisk.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1468)\n \"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 900)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 900)\n \"iexplore.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 900)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 900)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"SecretDisk.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":33,"imported_dlls_count":156,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":195,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"61545bc59c2d3350dc3b37ea","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"SecretDisk.exe","analysis_start_time":"2021-09-29T12:27:54+00:00","indicators_count":{"informative":29,"suspicious":26,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"205.196.223.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"address":"23.63.75.153","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"dns_resolutions":[{"domain":"crl.identrust.com","address":"23.63.75.153","ttl":3721,"country":"United States","registrar_name":"NETWORK SOLUTIONS, LLC.","registrar_name_servers":"NS.IDENTRUST.COM","registrar_creation_date":"2004-02-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"domain":"ocsp.sectigo.com","address":"104.18.30.182","ttl":3600,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"domain":"privacyroot.com","address":"205.196.223.84","ttl":300,"country":"United States","registrar_name":"DREAMHOST","registrar_organization":"PROXY PROTECTION LLC","registrar_name_servers":"NS1.DREAMHOST.COM","registrar_creation_date":"2008-08-26T19:29:03+00:00","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"domain":"x1.c.lencr.org","address":"104.121.200.104","ttl":120,"country":"United States","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"VERA.NS.CLOUDFLARE.COM","registrar_creation_date":"2020-06-29T21:59:03+00:00","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"http_requests":[{"host":"crl.identrust.com","host_ip":"23.63.75.153:80","url":"/DSTROOTCAX3CRL.crl","method":"GET","header":"GET /DSTROOTCAX3CRL.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.identrust.com","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}],"processes":[{"pid":2492,"ppid":0,"name":"SecretDisk.exe","command_line":"","sha256":"c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb","normalized_path":"C:\\SecretDisk.exe","uid":"00000000-00002492","icon":"$2d"},{"pid":320,"ppid":2492,"name":"iexplore.exe","command_line":"https://privacyroot.com/apps/scripts/uframework-web.pl?scn=sede&version=2106.00&fipr=b4ea54875f02055a46cd431022556adf&pcid=509ccbbdaec9970ae4f1b7940b08900e&location=site&iso2=en&lang_sede=","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002492","uid":"00000000-00000320"},{"pid":1112,"ppid":320,"name":"IEXPLORE.EXE","command_line":"SCODEF:320 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE","parent_uid":"00000000-00000320","uid":"00000000-00001112"},{"pid":2520,"ppid":0,"name":"dismhost.exe","command_line":"{79D75D60-19DA-4ACB-8999-EA3C4B2B37A9}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\TEMP\\36225C16-916B-48C2-B867-3D3E08AC7D19\\dismhost.exe","uid":"00000000-00002520","icon":"$2e"}],"all_imported_dlls":["oleaccrc.dll","dui70.dll","d3d11.dll","LogProvider.dll","RpcRtRemote.dll","rpcss.dll","ieproxy.dll","SensApi.dll","msimtf.dll","msvcrt.dll","msctf.dll","propsys.dll","duser.dll","comdlg32.dll","IEShims.dll","nlaapi.dll","webio.dll","msvcr90.dll","dwmapi.dll","wbemcomn.dll","userenv.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","dnsapi.dll","mscorwks.dll","imagehlp.dll","comctl32.dll","gdi32.dll","bcryptprimitives.dll","setupapi.dll","sechost.dll","DismCorePS.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","msimg32.dll","mpr.dll","profapi.dll","lpk.dll","wintrust.dll","uxtheme.dll","sqmapi.dll","WSHTCPIP.DLL","d3d10warp.dll","GdiPlus.dll","clr.dll","psapi.dll","clrjit.dll","cryptnet.dll","SSShim.dll","ieframe.dll","ucrtbase_clr0400.dll","DrUpdate.dll","ieui.dll","Wldap32.dll","mshtml.dll","deploy.dll","nlssorting.dll","advapi32.dll","System.ni.dll","netutils.dll","wbemprox.dll","iertutil.dll","wininet.dll","URLREDIR.DLL","SPInf.dll","secur32.dll","oleacc.dll","schannel.dll","wow64win.dll","drvstore.dll","shell32.dll","WMINet_Utils.dll","msvcr100.dll","KernelBase.dll","api-ms-win-downlevel-user32-l1-1-0.dll","version.dll","srvcli.dll","ssv.dll","wdscore.dll","DmiProvider.dll","rasadhlp.dll","DWrite.dll","cryptsp.dll","clbcatq.dll","fastprox.dll","imageres.dll","sspicli.dll","WindowsCodecs.dll","npmproxy.dll","wshqos.dll","bcrypt.dll","VxSSL64.dll","mscoreei.dll","sxs.dll","wow64cpu.dll","jscript9.dll","DismProv.dll","dhcpcsvc.dll","jp2ssv.dll","OSProvider.dll","msasn1.dll","dhcpcsvc6.dll","wow64.dll","ole32.dll","ExplorerFrame.dll","credssp.dll","gpapi.dll","devrtl.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","ncrypt.dll","oleaut32.dll","wmiutils.dll","rsaenh.dll","mscorlib.ni.dll","MSOHEV.DLL","dbghelp.dll","wbemsvc.dll","urlmon.dll","ws2_32.dll","cryptbase.dll","netprofm.dll","CbsCore.dll","devobj.dll","apphelp.dll","shlwapi.dll","vcruntime140_clr0400.dll","IPHLPAPI.DLL","mlang.dll","kernel32.dll","imm32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netapi32.dll","wkscli.dll","d2d1.dll","crypt32.dll","ntdsapi.dll","normaliz.dll","ntmarta.dll","xmllite.dll","usp10.dll","cfgmgr32.dll","winnsi.dll","FWPUCLNT.DLL","mswsock.dll","dxgi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscoree.dll","user32.dll","rpcrt4.dll","nsi.dll","api-ms-win-core-xstate-l2-1-0.dll","winhttp.dll","ntdll.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dismhost.exe.61545D9C.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"ver8109.tmp","sha256":"159bd4343f344a08f6af3b716b6fa679859c1bd1d7030d26ff5ef0255b86e1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"WindowsHardwareTelemetry.ini","sha256":"4b17bb264a5b4e97e9780067f31552197a11c96bcc1453502aeea88a0754367f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"0OAU6T5I.txt","sha256":"ef804b49161b30ff6f8371b4d6f6eadb2cc7dcd3288ac11f313a7e37d5b41316","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"230UZBI0.txt","sha256":"50af208bdfb317be705fce0b3a3e0c04fcf824346fcc5e4619b7dcc80582ecbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"3O1NEN4B.txt","sha256":"9e501f1bc219f497666b82c1c25da8b7b397a80d4143106d6f0897df7ee88e00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"7CS48IUV.txt","sha256":"f2d97a42987e90ba52810eb7da0f712b6fa18d7dd8cbee3bf345cad68e9ce7a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"HD0ISM6H.txt","sha256":"0c213589e42d180224cb2d7b305283326262e31cd1443c31d8d21fa0d42956b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"JRNO2NFU.txt","sha256":"21df8ba4ff6ec5382aabddb95ab0d322b94bf6f26f7f26751bee4fb0105f1f29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"M8L6TN0Q.txt","sha256":"bcfff493f615b7acf60b77286e50b605b9d599deb367c521be00cdd4405c2b8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"NPWCHAM7.txt","sha256":"997b905143bfd851f875e261f8d651eb2bfc4480e447e75b118c3758f7437b58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"XKFF4DPS.txt","sha256":"c1adcee90545d74bd2907e5e0c03df38ea80619f37b912a52318e15e2f0e5624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"YBFS3N7S.txt","sha256":"1fac0c704eb28dbd48285ede53a419a456133a98505b1c0941e84501e0a4a0e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"ver81F3.tmp","sha256":"159bd4343f344a08f6af3b716b6fa679859c1bd1d7030d26ff5ef0255b86e1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"103621DE9CD5414CC2538780B4B75751","sha256":"45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"a755b05ca5dfb3212ea33d4d9587b86f086a379fbe7bd9b9fd992b8d0bd92844","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sha256":"305346436f9a488b53f33be56e1cc4826b37170af69cc68f87c2a9f14e78e77b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"fe6795b7a0047f11e68f526ef783e24eb8b4c980d51574627c7ef60a41cad6d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"644B8874112055B5E195ECB0E8F243A4","sha256":"8aafde121ea245337058ad232481f273718aedf92ad6ee524604ca5bc728c2bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sha256":"cc836cb7940a8f59b950201e53632902992894c36c23a5aba2ebe783c0a65360","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"files_written":[{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\dc6f17d3b5a947b693fa471cfd23bbc8\\Accessibility.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9f55378d72425b996754ea45a6c99946\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\TEMP\\36225C16-916B-48C2-B867-3D3E08AC7D19\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\TEMP\\36225C16-916B-48C2-B867-3D3E08AC7D19\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\f5db2f7c181e6f1344c9bc8dbcffce3b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\sede2021","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\sede2021\\Settings","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\sede2021\\Temp","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%TEMP%\\~DF9E917E5B2D460464.TMP","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\229bcb0a37da96387ccb65d0db58b482\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{7290425E-2110-11EC-8E10-080027BFA640}.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%ALLUSERSPROFILE%\\WindowsHardwareTelemetry.ini","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\sede2021\\Settings\\UsageV4.ini","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\https:\\privacyroot.com\\apps\\scripts\\uframework-web.pl?scn=sede&version=2106.00&fipr=b4ea54875f02055a46cd431022556adf&pcid=509ccbbdaec9970ae4f1b7940b08900e&location=site&iso2=en&lang_sede=","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{7290425C-2110-11EC-8E10-080027BFA640}.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\dnserror[1]","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%TEMP%\\~DFFA4000B3DC290AF2.TMP","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\NewErrorPageTemplate[1]","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\errorPageStrings[1]","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1C8Y98H0\\httpErrorPagesScripts[1]","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\catroot2\\dberr.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_8FB29C35032AE1827A2754ED35D7F2E8","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver81F3.tmp","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon1A4O7PIN.png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001e.db","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_137095CCA1922136C4B9E18EE962B463","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver8109.tmp","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon9Y88D7TZ.png","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M8L6TN0Q.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XKFF4DPS.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\230UZBI0.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0OAU6T5I.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HD0ISM6H.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7CS48IUV.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YBFS3N7S.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JRNO2NFU.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_182DAED95AA6F1285FE339A5B91AB604","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NPWCHAM7.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3O1NEN4B.txt","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.4","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.3","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_289911146CA8EA5846A770DE7BCA5AF4","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8A7891822FCFF127E4EADADE9757112B","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0AB67BD4882FB0E09822529CFEB33A58","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\search[1].json","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Temp\\36225C16-916B-48C2-B867-3D3E08AC7D19\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\inf\\oem12.inf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\inf\\oem11.inf","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\SecretDisk.exe.config","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"C:\\SecretDisk.exe","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\92c67571960b3d7f3fd30bf9d4a9bc24\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"CRLS\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"CTLS\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_IE_EarlyTabStart_0x14c_Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_ConnHashTable<320>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_320","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_320","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IE_EarlyTabStart_0x14c_Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_ConnHashTable<320>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"IsoScope_140_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_140_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"61545bc59c2d3350dc3b37ea"}]}]}},"report_ids":{"sandbox_job_ids":["61545bc59c2d3350dc3b37ea"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample c1b95d3ce125… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample c1b95d3ce125…. Threat score 0/100. 0/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb"}],["$","meta","4",{"property":"og:title","content":"Sample c1b95d3ce125… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample c1b95d3ce125…. Threat score 0/100. 0/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c1b95d3ce125e4d49f57c73e7790d4ba4cca6a94eac59ef6703a61eff68284bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample c1b95d3ce125… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample c1b95d3ce125…. Threat score 0/100. 0/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]